Lines of code

Vulnerability details

Impact

Once state variable accountant is set, accountant and admin will no longer be updated using _setAccountantAddress function.

#Proof of Concept

    function _setAccountantAddress(address accountant_) external {
        require(msg.sender == admin);
        require(address(accountant) == address(0));
        accountant = accountant_;
        if (balanceOf(accountant) != type(uint).max) {
            _mint_to_Accountant(accountant);
            admin = accountant;
        }
    }

require(address(accountant) == address(0)) prevents setting new accountant address once accountant is initialized. In addition, if admin cannot call _setAccountantAddress, state variable admin cannot be updated as well.

Tools Used

Static analysis

Recommended Mitigation Steps

Consider adding a specification which allows changing accountant and admin once accountant is initialized.

The text was updated successfully, but these errors were encountered:

All reactions