# Ownership in BRC20Factory could be transferred using a 2 step procedure, similarly to Vault Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-L01 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description It's recommended to change owner using a 2 step procedure to mitigate the risk of the contract losing ownership due to incorrect address. ### Recommendation Implement the 2 step ownership transfer procedure with a pendingOnwer variable and acceptOwnership() function. [Here](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/Ownable2Step.sol) is an example implementation. ### Status Addressed in [#ee04c91](https://github.com/orangecryptohq/orange-bridge-contract/commit/ee04c91f9ce8a44e8a9111de3aa39af230031014). --- Related findings: - [BasicVaultFactory::createVault() inconsistent already existing vault check](https://0xsimao.com/findings/mitosis-create-inconsistent-already-existing): Mitosis