057.md

Early Umber Quail

Medium

MorphoLeverageModule Uses Ownable Instead of Ownable2Step

Summary

MorphoLeverageModule Uses Ownable Instead of Ownable2Step

Root Cause

The MorphoLeverageModule contract inherits from OpenZeppelin's Ownable contract instead of Ownable2Step, potentially allowing for accidental or malicious immediate transfer of ownership without the safety of a two-step process.

import { Ownable } from "@openzeppelin/contracts/access/Ownable.sol";

contract MorphoLeverageModule is ModuleBase, ReentrancyGuard, Ownable, IModuleIssuanceHook {
    // ... (contract implementation)
}

Internal pre-conditions

1. The contract is deployed and ownership is set.
2. The contract includes functions that are restricted to the owner.

External pre-conditions

1. The current owner has the ability to transfer ownership directly to a new address.

Attack Path

While not directly exploitable, this setup could lead to:

1. Accidental transfer of ownership to an incorrect address.
2. Malicious transfer of ownership if the owner's private key is compromised.
3. Immediate loss of control over the contract if the ownership is transferred to an invalid or inaccessible address.

Impact

1. Loss of Control: Immediate and irreversible loss of contract control if ownership is transferred to an incorrect or inaccessible address.
2. Security Risk: Increased vulnerability to attacks targeting the owner's account, as ownership transfer is immediate.

PoC

No response

Mitigation

Replace Ownable with Ownable2Step from OpenZeppelin:

import { Ownable2Step } from "@openzeppelin/contracts/access/Ownable2Step.sol";

contract MorphoLeverageModule is ModuleBase, ReentrancyGuard, Ownable2Step, IModuleIssuanceHook { // ... (rest of the contract implementation) }

This change implements a two-step ownership transfer process:

1. The current owner calls transferOwnership to propose a new owner.
2. The proposed owner must call acceptOwnership to complete the transfer.