mirror of
https://github.com/matrix-org/dendrite.git
synced 2026-01-16 18:43:10 -06:00
Impact: High Likelihood: Low According to the discussion with the team, it is expected that in Space contracts, only one Role can have the Permissions.Owner permission. Currently, multiple Roles can be created containing this permission. This is caused by Space.sol’s createRole() function allowing the OpenZeppelin owner to create new owner-permissioned roles without limit. Remediations to consider: Do not allow multiple roles to be created with the ownership permission. This could be done with something like: if Space.sol’s ownerRoleId is set, do not allow new roles to be created with the Permissions.Owner permission. Fixes HNT-703 as well |
||
|---|---|---|
| .. | ||
| localhost_space.go | ||