# KeyringCoreV2Base could use a 2 step admin transfer mechanism Low/Info · Three Sigma · Zero-knowledge compliance · 10th July, 2024 Finding 3S-Keyring-L03 of the Keyring Credentials security review. - Protocol: https://www.keyring.network/ - Report: /reports/keyring-ii - Source: https://cdn.sanity.io/files/qoqld077/production/75b68b74f4b0dc6fbcd94892d934547d8259b57a.pdf --- ### Description Admin transfer in KeyringCoreV2Base is performed at once, possibly setting the admin to an incorrect address. To mitigate this risk, protocols usually implement a 2 step mechanism, where a pending admin is set who has to call acceptAdmin() in order for the admin to actually change. This ensures that the admin is always correctly set. ### Recommendation Implement the 2 step mechanism. ### Status Acknowledged --- Related findings: - [Admin will not be able to upgrade the smart contracts, breaking core functionality and rendering the upgradeable contracts useless](https://0xsimao.com/findings/cork-protocol-upgrade-functionality-rendering-upgradeable): Cork Protocol - [When changing addresses, use 2 step transfer and/or contract size and/or address 0x0 checks](https://0xsimao.com/findings/fuji-finance-changing-addresses-transfer-0x0): Fuji Finance - [When changing addresses, use 2 step transfer and/or address 0x0 checks](https://0xsimao.com/findings/glacier-changing-addresses-transfer-0x0): Glacier