F-2023-0008·centralization-risk

Owner can renounce ownership

TL;DR

OpenZeppelin's renounceOwnership is exposed without a guard, so an accidental or unauthorized call leaves the contract permanently ownerless and breaks 16 admin paths.

Severity
LOW
Impact
MEDIUM
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

Typically, the contract's owner is the account that deploys the contract. As a result, the owner is able to perform certain privileged activities.

The OpenZeppelin's Ownable used in this project contract implements renounceOwnership. This can represent a certain risk if the ownership is renounced for any other reason than by design.

03Section · Impact

Impact

Renouncing ownership will leave the contract without an owner, thereby removing any functionality that is only available to the owner. In this codebase there are 16 functions that would be affected in such scenario.

04Section · Recommendation

Recommendation

It's recommended that the Owner is not able to call renounceOwnership without transferring the Ownership to other address before.

In addition, if a multi-signature wallet is used, calling renounceOwnership function should be confirmed for two or more users.

F-2023-0008

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx