Skip to content

Latest commit

 

History

History
52 lines (31 loc) · 2.67 KB

025.md

File metadata and controls

52 lines (31 loc) · 2.67 KB
Raw

Powerful Yellow Bear

High

changeOwner function will prevent new owner from modifying critical parameters in DebitaV3Aggregator, auctionFactoryDebita, buyOrderFactory

Summary

The use of the same parameter name owner in the changeOwner function as the state variable owner will cause a potential ownership change failure for the new owner as the current owner will fail to update the state variable, leaving the old owner with control. This flaw allows the current owner to retain control, preventing the new owner from modifying critical parameters such as fees, loan offers, and collateral settings.

Root Cause

In DebitaV3Aggregator.sol:682, the choice to use the same parameter name owner as the state variable owner is a mistake as it causes a conflict in the changeOwner function. The state variable is not updated when the function is called, preventing the actual ownership transfer and allowing the original owner to retain control over critical parameters.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/DebitaV3Aggregator.sol#L682-L686

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/buyOrders/buyOrderFactory.sol#L186-L190

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/auctions/AuctionFactory.sol#L218-L222

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. The owner calls changeOwner() function, but it doesn't actually update the owner state variable due to a naming conflict with the local owner variable.
  2. This allows the incorrect owner(Old Owner) to call functions like statusCreateNewOffers(), setValidNFTCollateral(), setNewFee(), setNewMaxFee(), setNewFeeConnector(), and setNewMinFee().
  3. The incorrect owner can alter critical parameters, affecting the contract’s functionality, even though the ownership transfer failed.

Impact

The failure to properly transfer ownership will allow the incorrect owner to modify critical parameters, such as fees and collateral settings, potentially causing financial loss, disruption of contract operations, or unintended behavior. This could undermine trust in the system and compromise the security and integrity of the contract.

PoC

No response

Mitigation

+    function changeOwner(address newOwner) public {
        // @audit owner is local variable - can't change owner
        require(msg.sender == owner, "Only owner");
        require(deployedTime + 6 hours > block.timestamp, "6 hours passed");
+        owner = newOwner;
    }