Description

In the current design of ownership transfer, the owner calls both request_transfer_ownership and execute_transfer_ownership to transfer ownership. The UpgradeCap is also transferred to the new owner, so if the new owner address is an incorrect address, the ownership cannot be revoked.

Impact

If the new owner address is an incorrect address, the ownership cannot be revoked. The receiver address should be a valid address that can receive the ownership.

Recommendations

We recommend changing the design to implement a proper two-step process where the new owner calls execute_transfer_ownership to claim the ownership and UpgradeCap.

Remediation

This issue has been acknowledged by MatrixDock, and a fix was implemented in commit c4890239↗.