hats-finance / Fenix-Finance-0x83dbe5aa378f3ce160ed084daf85f621289fb92f

0 stars 0 forks source link

`GaugeFactoryUpgradeable` will be useless if owner renounces ownership #19

Open hats-bug-reporter[bot] opened 9 months ago

hats-bug-reporter[bot] commented 9 months ago

Github username: @0xRizwan Twitter username: 0xRizwann Submission hash (on-chain): 0xbc89736f3b443aa84ec6dc9560fee615f844178070b53629ba861abe6e75d86c Severity: low

Description: Description\

GaugeFactoryUpgradeable inherits openzeppelin's OwnableUpgradeable and initialize the owner address by __Ownable_init which means the address deploying the contract will be the owner of GaugeFactoryUpgradeable

onlyOwner modifier has some priviledge functions which if owner renounces ownership either intensionally or mistakenly would result in failure in accessing below functions. Most possibly, it would require the redeployment of contract and point the factory address wherever used in other contracts.

    function setDefaultBlastGovernor(address defaultBlastGovernor_) external virtual onlyOwner {

    function changeImplementation(address _implementation) external onlyOwner {

    function setMerklGaugeMiddleman(address _newMerklGaugeMiddleman) external onlyOwner {

    function setDistribution(address _gauge, address _newDistribution) external onlyOwner {

However, instead of going from all such events, renounce ownership should be simply disabled.

Impact

Whole contracts functionality is permanently broken the owner renounces as the ownership either intensionally or mistakenly.

Recommendations

Recommend to disable the renounce ownership function in contract.

For example:

 function renounceOwnership () public override onlyOwner {
 revert (" can 't renounceOwnership here ");
BohdanHrytsak commented 9 months ago

Thank you for the submission.

This issue falls under Centralised risks & Misconfiguration, OOS

Also, in case of a configuration error, there is still a way to solve this problem