StabilityNexus / StabilityNexus/Chainvoice

[BUG]: Staged Ownership Reassignment Logic

Open
#131 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
10
Forks
47
Avg merge
17h 47m
Merged PRs (30d)
4

Description

Bug Description

Severity: High
Location: Chainvoice.sol (Admin Section)

Description

The smart contract currently lacks fundamental governance and ownership management capabilities. Specifically:

  1. No Ownership Transfer: The contract does not have any mechanism to securely transfer ownership to a new wallet address.
  2. No Ownership Renunciation: The current owner cannot renounce ownership to make the contract fully decentralized and immutable.
  3. Missing Admin Events: Critical state-changing functions like setFeeAmount and setTreasuryAddress do not emit events.

Impact

  • Permanent Loss of Control: If the current owner's private key is compromised, lost, or needs to be rotated to a multi-sig wallet, there is absolutely no way to migrate control. The contract would be permanently stuck or compromised.
  • Lack of Transparency: Off-chain systems, indexers, and DApp interfaces cannot track changes to the protocol's fee or treasury address because no events are broadcasted to the blockchain when they change.

Current Behavior

  • The owner variable is permanently set to the deployer in the constructor.
  • Calling setFeeAmount updates the state but remains invisible to off-chain listeners.

Expected Behavior (Resolution)

*Introduce a ownership transfer (transferOwnership and acceptOwnership) to prevent accidental transfers to incorrect or typo'd addresses.

  • Implement Renounce: Add a renounceOwnership function for future decentralization.
  • Emit Events: Broadcast FeeUpdated, TreasuryUpdated, OwnershipTransferStarted, and OwnershipTransferred events whenever admin changes occur.
Steps to Reproduce

No response

Logs and Screenshots

No response

Environment Details

No response

Impact

Critical - Application is unusable

Code of Conduct
  • I have joined the Discord server and will post updates there
  • I have searched existing issues to avoid duplicates

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in Chainvoice.sol's Admin Section by reading the owner state and the setFeeAmount and setTreasuryAddress functions. Trace how administrative changes currently work, then verify that two-step ownership transfer, renunciation, and the requested ownership, fee, and treasury events are covered. Done means these changes are available and state changes are observable through events.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.