Access control vulnerability updated. #87
Conversation
There was a problem hiding this comment.
Tbh I feel like most of this can really be simplified. The core of the issue mostly just comes down to lack of access control being the problem and adding access control being the solution. The additional explanations kinda take away from it and are mostly not relevant to the core issue
| } | ||
| ``` | ||
| If the contract assigns multiple roles with ``onlyOwner`` privileges, it increases the attack surface. An attacker compromising a single owner account could execute critical functions. |
There was a problem hiding this comment.
This shouldn't be possible with OZ Ownable though
There was a problem hiding this comment.
My bad. OZ Ownable is the fix for role based access control with multiple onlyOwner privileges. Will fix.
|
Yeah, I overdid it. How about adding a simple example like a |
| - https://metaschool.so/articles/access-control-vulnerabilities-in-smart-contracts/ | ||
| - https://medium.com/rektify-ai/how-to-mitigate-access-control-vulnerability-6df74c82af98 | ||
| - https://github.com/Quillhash/Solidity-Attack-Vectors/blob/main/data/1.md |
There was a problem hiding this comment.
@0xSandyy, Could you please convert links to hyper links
There was a problem hiding this comment.
Thanks for the remainder!
|
Replaced by: #101 |
Related Issue
Checklist
Describe the changes you've made:
I updated the insufficient access control vulnerability by adding some access control vulnerabilities and some mitigation strategies/best practices.
Type of change
Select the appropriate checkbox: