search

code-423n4 / 2022-01-xdefi-findings

0 stars 0 forks source link

Can not change the ownership of the contract XDEFIDistribution #117

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

MaCree

Vulnerability details

Impact

can not change the ownership of the contract XDEFIDistribution

Proof of Concept

no way to set the value of the public variable pendingOwner, so no one can really use function acceptOwnership() to accept the ownership.

Tools Used

code review

Recommended Mitigation Steps

Reference: openzeppelin-solidity/contracts/ownership/Claimable.sol

deluca-mike commented 2 years ago

This is invalid. pendingOwner = newOwner_ happens right here: https://github.com/XDeFi-tech/xdefi-distribution/blob/v1.0.0-beta.0/contracts/XDEFIDistribution.sol#L70 in proposeOwnership.

Ivshti commented 2 years ago

agreed, invalid finding