code-423n4 / 2022-10-thegraph-findings

0 stars 0 forks source link

Set admin without accept method #237

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/upgrades/GraphProxyStorage.sol#L80-L87

Vulnerability details

Impact

Set admin without method for accept is a bad practice. Also there is no check for zero.

Proof of Concept

https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/upgrades/GraphProxyStorage.sol#L80-L87

Tools Used

Code analytics

Recommended Mitigation Steps

Create method acceptAdmin() and and check for zero address.