Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

uberOwner cannot do all the things an owner can #156

Open
code423n4 opened this issue Jun 16, 2021 · 2 comments
Open

uberOwner cannot do all the things an owner can #156

code423n4 opened this issue Jun 16, 2021 · 2 comments
Labels

Comments

@code423n4
Copy link
Contributor

Handle

cmichel

Vulnerability details

Vulnerability Details

The uberOwner cannot do the same things the owner can.
They can "only" set the reference contract for the market.

The same ideas apply to Treasury and Factory's uberOwner.

Impact

The name is misleading as it sounds like the uber-owner is more powerful than the owner.

Recommended Mitigation Steps

Uberowner should at least be able to set the owner if not be allowed to call all functions that an owner can.
Alternatively, rename the uberOwner.

@code423n4 code423n4 added 1 (Low Risk) bug Something isn't working labels Jun 16, 2021
code423n4 added a commit that referenced this issue Jun 16, 2021
@mcplums
Copy link
Collaborator

mcplums commented Jun 17, 2021

I like this! Is not too important, but can't hurt to have uber owner able to change the owner.

@Splidge
Copy link
Collaborator

Splidge commented Jun 21, 2021

I will come back to this issue if time allows. Ownable.sol has been made such that you can't override transferOwnership() or the onlyOwner modifier.
This means the next best option would be changing to AccessControl.sol which is more effort than I think the benefit warrants given our current timescale.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants