search

code-423n4 / 2021-10-pooltogether-findings

0 stars 0 forks source link

No Owner transfer method. #2

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

pants

Vulnerability details

You don't have an owner transfer method. If you want in the future to change the owner you need to redeploy the whole contract.

PierrickGT commented 3 years ago

We are using our own custom library to handle ownership and managership of our contracts. Owner can be transferred through a two steps process to avoid a failure scenario where we would have set a wrong address by mistake.

The process is the following:

  1. The current owner calls {transferOwnership} to set a pendingOwner
  2. The pendingOwner calls {claimOwnership} to accept the ownership transfer
GalloDaSballo commented 3 years ago

Finding is wrong, sponsor thoughtfully wrote code to transferOwnership as well as renounceOwnership