mediumAccess controlEVM-Solidity
Winnables Raffles: The setRole() function grants role instead of removing
- Payout
- $0
- Protocol
- Winnables Raffles
- Disclosed
- Aug 20, 2024
- Source
- sherlock
Winnables Raffles uses a bit-flag based role system where each user holds a bytes32 bitfield and an admin can grant or revoke roles via setRole(). The bug is that the internal _setRole() only ever ORs the role bit in regardless of the requested status, so call …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.