Lines of code

Vulnerability details

Impact

The function does not have access control before the accountant address is set, allowing anyone to call the function, gain admin privileges, and set the accountant address.

Proof of Concept

CNote.sol#L17

Recommended Mitigation Steps

Include access control even when _accountant is not set or set _accountant during deployment

The text was updated successfully, but these errors were encountered:

All reactions