search

code-423n4 / 2021-06-realitycards-findings

3 stars 2 forks source link

uberOwner cannot do all the things an owner can #156

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The uberOwner cannot do the same things the owner can. They can "only" set the reference contract for the market.

The same ideas apply to Treasury and Factory's uberOwner.

Impact

The name is misleading as it sounds like the uber-owner is more powerful than the owner.

Recommended Mitigation Steps

Uberowner should at least be able to set the owner if not be allowed to call all functions that an owner can. Alternatively, rename the uberOwner.

mcplums commented 3 years ago

I like this! Is not too important, but can't hurt to have uber owner able to change the owner.

Splidge commented 3 years ago

I will come back to this issue if time allows. Ownable.sol has been made such that you can't override transferOwnership() or the onlyOwner modifier. This means the next best option would be changing to AccessControl.sol which is more effort than I think the benefit warrants given our current timescale.