Ramp Network security record

Smart contracts will often have an owner to designate the person with special privileges to make modifications to the smart contract or execute specific functions. Exploit Scenario: A malicious admin could take advantage of users in the following scenarios: 1. The admin could create a number of "fake" swaps. Users would get their funds locked up in the escrow but the malicious admin would never make a corresponding fiat payment. When the swaps expire and users want to withdraw their locked up funds using returnFunds(), they would have to pay the fee and admin would unfairly benefit. 2. Since WithOracles has an owner, a malicious admin could decide to release funds from a swap without the corresponding fiat payment. Consequently, users could lose their locked up funds.

The clone-and-own approach involves copying and, possibly, adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries. Although we have not found any vulnerabilities in the contracts Ownable and Stoppable, they have corresponding OpenZeppelin contracts.