Single-step ownership transfer in upgradeable contract
An upgradeable contract used a single-step ownership transfer, which combined with its upgrade authority makes accidental misconfiguration particularly damaging.
Description
Upgradeable contracts hold powerful authority — they can typically change their own logic. Using a single-step ownership transfer for an upgradeable contract amplifies the risk of accidentally handing that authority to the wrong address.
Impact
A typo on transfer can permanently surrender upgrade authority. For upgradeable contracts this is particularly damaging because the new owner can rewrite the contract's logic.
Recommendation
Use a two-step ownership transfer pattern (OpenZeppelin Ownable2StepUpgradeable) for any upgradeable contract.
Composable Security ID: NRL-6c19a5e-L04. Neverland Money: Fixed. Composable Security: Fix verified during retest.