setSentinel actually adds sentinel

[code423n4]

Handle

pauliax

Vulnerability details

Impact

Please note that function setSentinel does not actually remove an existing sentinel but adds a new address with this role. I am not sure if this is intended behavior and you are aware of this, but the function name is a bit misleading in my opinion, so submitting this FYI. Anyway, roles can be managed directly if necessary (grantRole/revokeRole).

[Xuefeng-Zhu]

AccessControl.sol provides function to revoke role

[0xleastwood]

I don't think the sponsor is understanding the issue. There seems to be a mismatch with the naming of setSentinel and the actual behaviour. Multiple sentinel accounts can be given access to the SENTINEL_ROLE. I fully understand if the sponsor is aware and has acknowledged the issue, but for judging purposes, I will leave this as is.

[Xuefeng-Zhu]

I am going to remove setSentinel function, since it can be managed by AccessControl directly