search

code-423n4 / 2022-12-tigris-findings

8 stars 4 forks source link

Might lose manager forever #656

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/BondNFT.sol#L366

Vulnerability details

Impact

If project sets new manager with a typo, might lose manager forever

Proof of Concept

    function setManager(
        address _manager
    ) public onlyOwner() {
        manager = _manager;
    }

https://twitter.com/realgmhacker/status/1603362870699429889?s=20&t=vm4wY1ITefLhCW8BDa0oig

Recommended Mitigation Steps

implement pending() function to check and validate manager.

c4-judge commented 1 year ago

GalloDaSballo marked the issue as unsatisfactory: Overinflated severity

GalloDaSballo commented 1 year ago

Lack of 2 step is NC here, closing as overly inflated