Possible loss of ownership

[code423n4]

Lines of code

https://github.dev/code-423n4/2022-05-aura/blob/90e63758c023af079b5347a08b006ad0e0730ab3/contracts/AuraStakingProxy.sol#L116-L117

Vulnerability details

Impact

It's possible to lose the ownership under specific circumstances.

Proof of Concept

The ownership change logic of the AuraStakingProxy contract implements an incorrect ACK system, since the user who has to call the applyPendingOwner method is the previous owner of the contract. So if the owner delegates the property to a third party, and immediately loses the key, or dies. The property change cannot be carried out due to the logic error described above.

Source code:

• AuraStakingProxy.sol#L116-L117

Recommended Mitigation Steps

Change the require to be like:

+        require(msg.sender == pendingOwner, "!auth");
-        require(msg.sender == owner, "!auth");
-        require(pendingOwner != address(0), "invalid owner");

[0xMaharishi]

Duplicate of #102 and many more. Also should be 0 or 1

[dmvt]

I disagree with the sponsor. As noted, this could lead to a loss of ownership which would be very bad. Issue stands.

[dmvt]

Per #364 (comment) I have decided to downgrade this to QA.

[dmvt]

Grouping this with the warden’s QA report, #83