No transfer-accept ownership pattern or two-step process for transfer ownership

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-artgobblers/blob/main/src/ArtGobblers.sol#L83

Vulnerability details

Impact

If we look at these contracts:

• ArtGobbler.sol
• GobblerReserve.sol

All of them inherits Solmate Auth Owned contract. This type of ownable contract is a standard way of owning a contract. But there is a potential issue within the Owned contract, it allows for the transfer of ownership without validating that the address is a valid address in control of some expected recipient. If this function is used incorrectly, mistype, or any unexpected input, the admin user might be lost and potentially locked up for future usage.

This is categorized as a medium severity, similar to previous reported contests, because this could impact availability of protocol. https://code4rena.com/reports/2021-11-bootfinance#m-12-no-transfer-ownership-pattern

Recommended Mitigation Steps

Consider implementing a transfer-accept ownership pattern or two-step process in those contracts when transfering ownership. This allow an owner to accept the transfer insuring that the account is controlled by a valid user.

[Shungy]

Design choice. This is informational or low risk at most. Not med.

[GalloDaSballo]

Dup of https://github.com/code-423n4/2022-09-artgobblers-findings/issues/440