code-423n4 / 2021-06-tracer-findings

1 stars 0 forks source link

The `transferOwnership` function of `Liquidation` lacks a non-zero address check #136

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

The transferOwnership function of Liquidation does not check the provided parameter, newOwner, is non-zero. However, the same function in TracerPerpetualSwaps does. The contract could lose the owner if the parameter is provided as zero accidentally.

Proof of Concept

Referenced code: Liquidation.sol#L445-L447

Recommended Mitigation Steps

Add a require(newOwner != address(0), "...") check after line 445.

OsmanBran commented 3 years ago

Resolved in https://github.com/tracer-protocol/perpetual-contracts/pull/172

loudoguno commented 3 years ago

closing to reflect findings from judges sheet as duplicate of #49