Zellic - Audit Reports

Logic of `change_admin` is inconsistent with `instantiate`

When instantiating the CosmosWasm contracts, the admin is set up and also added as a member:

#[entry_point]
pub fn instantiate( eps: DepsMut, _env: Env, _info: MessageInfo, msg: InitMsg) -> StdResult<Response> {
    let whitelist = Whitelist {
        members: vec![msg.admin.clone()].into_iter().collect(),
        admin: msg.admin,
    };
    WHITELIST.save(deps.storage, &whitelist)?;
    Ok(Response::default())
}

But when change_admin is called, the new admin is removed from the member list (and the old admin is kept as a member):

ExecuteMsg::ChangeAdmin { address } => {
    check_admin(check)?;
    let api = deps.api;
    let addr = api.addr_validate(address.as_str()).unwrap();
    whitelist.admin = addr.clone().into_string();
    whitelist.members.remove(addr.as_str());
    WHITELIST.save(deps.storage, &whitelist)?;

Consider changing the logic so that change_admin does not affect the member list (which can be done in a separate call to add_member or remove_member) or to make it match the instantiate method so that the admin becomes a member.

Logic of change_admin is inconsistent with instantiate

Logic of `change_admin` is inconsistent with `instantiate`