Submitted by 0xSmartContract, also found by csanuragjain, djxploit, hansfriese, Josiah, leosathya, M4TZ1P, sorrynotsorry, wagmi, zzykxx, Aymen0909, chaduke, SooYa, Mukund, pashov, Dravee, catchup, rvierdiiev, Nyx, vv7, cccz, ladboy233, and supernova
PendingOwnable.sol#L42
Typically, the contracts owner is the account that deploys the contract. As a result, the owner is able to perform certain privileged activities.
However, Owner privileges are numerous and there is no timelock structure in the process of using these privileges.
The Owner is assumed to be an EOA, since the documents do not provide information on whether the Owner will be a multisign structure.
In parallel with the private key thefts of the project owners, which have increased recently, this vulnerability has been stated as medium.
Similar vulnerability;
Private keys stolen:
Hackers have stolen cryptocurrency worth around 552 million from a blockchain project linked to the popular online game Axie Infinity, in one of the largest cryptocurrency heists on record. Security issue : PrivateKey of the project officer was stolen:
https://www.euronews.com/next/2022/03/30/blockchain-network-ronin-hit-by-552-million-crypto-heist
onlyOwner powers;
1- A timelock contract should be added to use onlyOwner privileges. In this way, users can be warned in case of a possible security weakness.
2- onlyOwner can be a Multisign wallet and this part is specified in the documentation.
0x0Louis (Trader Joe) acknowledged and commented:
Alex the Entreprenerd (judge) commented:
