Owner should not be able to renounce ownership

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/ownable/OwnableUpgradeable.sol#L114-L116

Vulnerability details

Impact

The VRFNFTRandomDraw contract inherits from the OwnableUpgradable contract which gives the contract owner the ability to renounce ownership of the contract as seen here https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/ownable/OwnableUpgradeable.sol#L114-L116.

The VRFNFTRandomDraw contract heavily relies on the owner to perform critical operations including calling startDraw (), redraw() and also lastResortTimelockOwnerClaimNFT () functions. If the ownership of the contract at some point is resigned then these operations would not be possible

Proof of Concept

https://github.com/code-423n4/2022-12-forgeries/blob/fc271cf20c05ce857d967728edfb368c58881d85/src/ownable/OwnableUpgradeable.sol#L114-L116

Tools Used

Recommended Mitigation Steps

Consider removing the ability of the owner to renounce ownership via the resignOwnership () function

[c4-judge]

gzeon-c4 marked the issue as unsatisfactory:
Invalid

[neumoxx]

Hi @gzeon-c4, resignOwnership is a function available to call in the contract, and can lead to loss of NFTs, I don't see why you marked the issue as unsatisfactory.

[gzeoneth]

This is not an issue because it have the same effect as if the owner decided to do nothing.