Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

implement 2-step transfer process of ownership in AuthInitialized.sol #41

Closed
code423n4 opened this issue Jan 8, 2023 · 1 comment
Closed

implement 2-step transfer process of ownership in AuthInitialized.sol #41

code423n4 opened this issue Jan 8, 2023 · 1 comment
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value invalid This doesn't seem right withdrawn by warden Special case: warden has withdrawn this submission and it can be ignored

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2023-01-astaria/blob/1bfc58b42109b839528ab1c21dc9803d663df898/src/AuthInitializable.sol#L95-L100

Vulnerability details

Impact

Transfer of ownership is a delicate and irreversible process, it could leave a contract useless, with a two step process we add a guard against typos or bad copy/paste.

Proof of Concept

OpenZeppelin/openzeppelin-contracts#3620

Tools Used

Manual Audit

Recommended Mitigation Steps

Implement 2-step process in transferring ownership.
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Jan 8, 2023
code423n4 added a commit that referenced this issue Jan 8, 2023
@code423n4
Praise issue #41
855e042
@code423n4 code423n4 added invalid This doesn't seem right withdrawn by warden Special case: warden has withdrawn this submission and it can be ignored and removed bug Something isn't working labels Jan 18, 2023
@code423n4
Copy link
Contributor Author

Withdrawn by Praise

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value invalid This doesn't seem right withdrawn by warden Special case: warden has withdrawn this submission and it can be ignored
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@code423n4