Description

The OstiumRegistry allows governance to update, register, or unregister any contract in the protocol. The governance address could also be updated using the setGov function by the owner of the contract. This introduces centralization risks that users of the protocol should be aware of, as it grants a single point of control over the system.

Impact

The owner could update the governance address, leading to centralization risks, which include the ability of the admin to pause and unpause the protocol at their discretion, whitelisting an address, updating important parameters in the protocol, and so on.

Recommendations

It is recommended to implement additional measures to mitigate these risks, such as implementing a multi-signature requirement for admin access or limiting the frequency of usage.

Remediation

Ostium Labs will mitigate the centralization risk by setting the Owner of OstiumRegistry to be a OstiumTimelockOwner contract which is an OpenZeppelin TimelockController.