Owner can prevent from draw running the second time

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/VRFNFTRandomDraw.sol#L203

Vulnerability details

Impact

The owner can decide not to redraw. Therefore if no winner is selected the first time, the owner can wait for the lock period to end and get their NFT back.

Proof of Concept

redraw function is set with the onlyOwner modifier. It can only be called by the owner.
https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/VRFNFTRandomDraw.sol#L203:

    function redraw() external onlyOwner returns (uint256) {

Tools Used

VS Code

Recommended Mitigation Steps

The protocol has placed a lot of trust in the owner. Users should be able to call redraw as well.

[c4-judge]

gzeon-c4 marked the issue as primary issue

[c4-judge]

gzeon-c4 marked the issue as satisfactory

[gzeoneth]

I think this is low risk given the permissioned design of the contract, will wait for sponsor comment.

[iainnash]

@gzeoneth Agreed with low/QA. The contract is permissioned due to the dependency on chainlink and a relative level of trust of the owner.

[c4-sponsor]

iainnash marked the issue as sponsor disputed

[c4-judge]

gzeon-c4 changed the severity to QA (Quality Assurance)

[c4-judge]

gzeon-c4 marked the issue as grade-b