The Basket.changePublisher function is used for both setting a new pending publisher as well as accepting the publisher transfer from the pending publisher.
Impact
Once a pending publisher has been set, no other publisher can be set and if the pending publisher does not accept it, the contract is locked out of setting any other publishers.
Setting a wrong publisher can naturally occur.
Recommended Mitigation Steps
Add an option to set a new pending publisher even if there already is a pending publisher.
Handle
cmichel
Vulnerability details
The
Basket.changePublisher
function is used for both setting a new pending publisher as well as accepting the publisher transfer from the pending publisher.Impact
Once a pending publisher has been set, no other publisher can be set and if the pending publisher does not accept it, the contract is locked out of setting any other publishers. Setting a wrong publisher can naturally occur.
Recommended Mitigation Steps
Add an option to set a new pending publisher even if there already is a pending publisher.