windingtree / lif2 Goto Github PK

This repo hasn't been published to npm.js. Suggest that this is done and that a CI process is put in place when a new release version is tagged that an automatic push be done.

tl;dr
Superuser functions such as pause(), stop() are assigned to an EOA (nominally the Winding Tree Deployer). This represents immediate medium level security risks.

Overview

The Lif2 implementation contains two types of superuser:

1. ProxyAdmin - this is responsible for the token logic of the contract, and represents essentially root level access to the contract state by virtue of token logic modification. This is guarded by the WT Community multi-sig 0x876969b13dcf884C13D4b4f003B69229E6b7966A.

2. owner - this is an account stored in state for the contract that allows pause() and stop() on the contract - used for pausing the contract in it's entirety or stopping the claimable period. This is currently set the Winding Tree Deployer 0x008235a1Ed13130861b82DCF21FB2E39396F0673.

Hypothetically should the deployer EOA key be compromised, there would be no loss of funds, but there would be a denial of service, attack vector, freezing all token holder's balance of LIF.

Therefore it is strongly recommended to immediately execute the following:

Lif2.transferOwnership(0x876969b13dcf884C13D4b4f003B69229E6b7966A)