acceptOwner should reset pendingOwner

[code423n4]

Handle

p4st13r4

Vulnerability details

Impact

TimeswapFactory allows to transfer ownership of the contract, however pendingOwner is never reset upon accepting the ownership. Since it’s a public state var, it’s a good practice to reset it to 0 after the operation

Proof of Concept

function acceptOwner() external override {
    require(msg.sender == pendingOwner, 'E102');
    owner = msg.sender;

    emit AcceptOwner(msg.sender);
}

Tools Used

Editor

Recommended Mitigation Steps

Add

pendingOwner = address(0)

[amateur-dev]

Similar issue reported over here #83 ; hence closing this