Use two steps in order to change the uberOwner

[code423n4]

Handle

a_delamo

Vulnerability details

Impact

In all three contracts (RCFactory, RCOrderbook and RCTreasury) in order to apply or execute important changes/functionalities, you need to be the uberOwner.

In order to change the uberOwner, you would execute the following method:

    function changeUberOwner(address _newUberOwner) external {
        require(msgSender() == uberOwner, "Extremely Verboten");
        require(_newUberOwner != address(0));
        uberOwner = _newUberOwner;
    }

If the wrong address would be introduced, it would make the contract unusable.

Recommended Mitigation Steps

I would recommend using a two steps process. This way we would protect for human errors.

    address public uberOwner;
   address public proposedUberOwner;

    function proposeNewUberOwner(address _newUberOwner) external {
        require(msgSender() == uberOwner, "Extremely Verboten");
        require(_newUberOwner != address(0));
        proposedUberOwner= _newUberOwner;
    }

   function becomeUberOwner() external {
        require(msgSender() == proposedUberOwner, "Extremely Verboten");
        uberOwner = proposedUberOwner;
        proposedUberOwner = address(0);
   }

[Splidge]

Duplicate of #5

[dmvt]

duplicate of #105