code-423n4 / 2021-10-union-findings

0 stars 0 forks source link

Treasury setAdmin function #107

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

pants

Vulnerability details

Treasury setAdmin function doesn't check the new admin is a valid one. The admin has too much power to actually burn all funds by transferring them to address(0) for example. We suggest at least check it isn't 0. Maybe even make it a two phase check that to verify you put the right address.

GeraldHost commented 3 years ago

84

GalloDaSballo commented 3 years ago

Duplicate of #84