Audit Fixes 3 - [M-1] More than one Role can contain the Permissions.Owner permission (#1429)

Browse source

Impact: High

Likelihood: Low

According to the discussion with the team, it is expected that in Space
contracts, only one Role can have the Permissions.Owner permission.
Currently, multiple Roles can be created containing this permission.
This is caused by Space.sol’s createRole() function allowing the
OpenZeppelin owner to create new owner-permissioned roles without limit.

Remediations to consider:

Do not allow multiple roles to be created with the ownership permission.
This could be done with something like: if Space.sol’s ownerRoleId is
set, do not allow new roles to be created with the Permissions.Owner
permission.

 Fixes HNT-703 as well

...

This commit is contained in:

Giuseppe Rodriguez 2023-02-07 19:23:07 -08:00 committed by GitHub

parent 7d6ffad2de

commit cade6d1de3

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Show stats Download patch file Download diff file Expand all files Collapse all files

2

zion/contracts/localhost_space/localhost_space.go

View file

File diff suppressed because one or more lines are too long