Submitted by p4st13r4, also found by 0x52 and Tutturu
Affected code:
The function _setAccountantContract() is supposed to be called after contract initialization, so that the accountant is immediately set. However, this function completely lacks any access control (its just public) so an attacker can monitor the mempool and frontrun the transaction in order to become both accountant and admin
Editor
The function should:
tkkwon1998 (Canto) confirmed
Alex the Entreprenerd (judge) commented:
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
