Challenge 11

tx.origin Misuse

HighAccess control

Challenge

The owner can be changed by setOwner. What prevents an arbitrary caller from taking ownership?

Starter code

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract MissingFunction {
  address public owner;

  constructor() {
    owner = msg.sender;
  }

  function setOwner(address _newOwner) public {
    owner = _newOwner;
  }
}

Show hint

State-changing administrative functions need an authorization check.