064.md

Fantastic Pickle Starfish

High

ChangeOwner Problems

Summary

In DebitaV3Aggregator.sol:682 anyone can call changeOwner as it is checking whether the msg.sender is equal to the sent address and also the owner cannot be changed by no one as it is resetting the variable passed when calling the function.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/DebitaV3Aggregator.sol#L682-L686

Root Cause

In DebitaV3Aggregator.sol:682:

function changeOwner(address owner) public {
    require(msg.sender == owner, "Only owner");
    require(deployedTime + 6 hours > block.timestamp, "6 hours passed");
    owner = owner;
}

This check require(msg.sender == owner, "Only owner"); is only checking if the msg.sender is equal to the newly sent address. This means that anyone can call this function with their own address.

Also this line owner = owner; is just setting the newly created variable owner to itself and is not changing the state.

Internal pre-conditions

1. Using the changeOwner function

External pre-conditions

None

Attack Path

None

Impact

The functionality of changing owner does not work at all which can cause serious issues in the case in which this operation is critically needed (for example the private key of the already set owner is compromised).

PoC

None

Mitigation

Change the function as it follows:

-function changeOwner(address owner) public {
+function changeOwner(address _owner) public {
    require(msg.sender == owner, "Only owner");
    require(deployedTime + 6 hours > block.timestamp, "6 hours passed");
-   owner = owner;
+   owner = _owner;
}