Open code423n4 opened 2 years ago
Alternatively, as the onlyOwner role is not used throughout the contract, it may be useful to remove this contract entirely from the EmergencyGovernable.sol contract.
Great catch. I think this was a vestige from early iterations.
Handle
leastwood
Vulnerability details
Impact
Swap.sol
inherits OpenZeppelin'sOwnable
contract which enables theonlyOwner
role to transfer ownership to another address. It's possible that theonlyOwner
role mistakenly transfers ownership to the wrong address, resulting in a loss of theonlyOwner
role.Proof of Concept
https://github.com/code-423n4/2021-10-tally/blob/main/contracts/governance/EmergencyGovernable.sol https://github.com/code-423n4/2021-10-tally/blob/main/contracts/swap/Swap.sol
Tools Used
Manual code review.
Recommended Mitigation Steps
Consider overriding the
transferOwnership()
function to first nominate an address as the pending owner and implementing anacceptOwnership()
function which is called by the pending owner to confirm the transfer. Alternatively, as theonlyOwner
role is not used throughout the contract, it may be useful to remove this contract entirely from theEmergencyGovernable.sol
contract.