Pending owner can be the wrong recipient of ownership

[code423n4]

Lines of code

https://github.com/code-423n4/2023-06-lukso/blob/9dbc96410b3052fc0fd9d423249d1fa42958cae8/contracts/LSP0ERC725Account/LSP0ERC725AccountCore.sol#L624-L640

Vulnerability details

Impact

An attacker can call the acceptOwnership function with their address as the pending owner before the legitimate pending owner has a chance to call the function

Proof of Concept

The transferOwnership() function allows the current owner to set a pending owner. The acceptOwnership() function is supposed to be called by the pending owner to accept ownership. However, there are no verification in the acceptOwnership() function to verify that the caller is indeed the pending owner. This means that any address can call this function and become the owner of the contract. An attacker can exploit this vulnerability by performing the following steps:

• Call the transferOwnership() function with their desired address as the pending owner.
• Call the acceptOwnership() function from any address, not necessarily the pending owner's address.
• The contract will transfer ownership to the caller of the acceptOwnership() function, regardless of whether they are the intended pending owner or not.

Tools Used

Manual

Recommended Mitigation Steps

Finetune the acceptOwnership() function to verify that the caller is the pending owner before transferring ownership. This can be done by comparing the caller's address with the pending owner's address before executing the ownership transfer

Assessed type

Token-Transfer

[c4-pre-sort]

minhquanym marked the issue as primary issue

[c4-pre-sort]

minhquanym marked the issue as low quality report

[minhquanym]

Seems invalid

[c4-sponsor]

CJ42 marked the issue as sponsor disputed

[CJ42]

This issue is invalid, the check is performed in the internal function _acceptOwnership().

https://github.com/lukso-network/lsp-smart-contracts/blob/32ad32f942888398bf99b039e98e238c3146c1b3/contracts/LSP14Ownable2Step/LSP14Ownable2Step.sol#L137-L140

[c4-judge]

trust1995 marked the issue as unsatisfactory: Invalid