Fuel Labs Sway Standards Security Review Report
July 2024
Scope
The analyzed resources are located on:
The issues described in this report were acknowledged.
Summary
Weaknesses
This section contains the list of discovered weaknesses.
FUEL6-1 SINGLE-STEP OWNERSHIP CHANGE INTRODUCES RISKS
Severity:
Status:
Informational
Path:
src14/owned_proxy/src/main.sw::set_proxy_owner()#L145-L147
Description:
The set_proxy_owner() function in the smart contract is intended to allow the current proxy owner to transfer ownership to a new owner.
Single-step ownership transfers add the risk of setting an unwanted owner by accident if the ownership transfer is not done with excessive care.
The two-step ownership transfer pattern offers a robust solution by introducing a two-step process that enhances security and control over ownership transitions.
Pattern Description:
- Initiation: The current owner initiates the transfer by specifying the new owner's address.
- Confirmation: The new owner confirms the transfer request and completes the ownership transition.
fn set_proxy_owner(new_proxy_owner: State) {
_set_proxy_owner(new_proxy_owner, storage.proxy_owner);
}
Remediation:
Consider employing two-step ownership transfer mechanisms.