Common vulnerabilities related to access control The most common vulnerabilities related to access control can be narrowed down as below.
- Missed Modifier Validations — It is important to have access control validations on critical functions that execute actions like modifying the owner, transfer of funds and tokens, pausing and unpausing the contracts, etc. Missing validations either in the modifier or inside require or conditional statements will most probably lead to compromise of the contract or loss of funds.
- Incorrect Modifier Names — Due to the developer’s mistakes and spelling errors, it may happen that the name of the modifier or function is incorrect than intended. Malicious actors may also exploit it to call the critical function without the modifier, which may lead to loss of funds or change of ownership depending on the function’s logic.
- Overpowered Roles — Allowing users to have overpowered roles may lead to vulnerabilities. The practice of least privilege must always be followed in assigning privileges.
Implement access control like onlyOwner in critical functions.
https://blog.solidityscan.com/access-control-vulnerabilities-in-smart-contracts-a31757f5d707 https://www.dasp.co/#item-2