Skip to content
Request an audit

‹ Findings database

KeyringCoreV2Base could use a 2 step admin transfer mechanism

Low/InfoKeyring Credentials audit·Three Sigma·Zero-knowledge compliance·10th July, 20243S-Keyring-L03

Description

Admin transfer in KeyringCoreV2Base is performed at once, possibly setting the admin to an incorrect address. To mitigate this risk, protocols usually implement a 2 step mechanism, where a pending admin is set who has to call acceptAdmin() in order for the admin to actually change. This ensures that the admin is always correctly set.

Recommendation

Implement the 2 step mechanism.

Status

Acknowledged

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests