# OwnableSmartWallet: Multiple approvals can lead to unwanted ownership transfers

OwnableSmartWallet revokes only the claiming address's approval on ownership transfer, leaving other stale approvals that let a prior-approved address seize ownership later.

- Payout: Contest reward
- Severity: medium
- Program: Stakehouse Protocol
- Credited: aphak5010
- Disclosed: 2023-01-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-stakehouse-findings/issues/99
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-07
- Tags: domain:web3 impact:privesc kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** OwnableSmartWallet.sol smart contract ownership approval mapping
**Root cause:** On ownership transfer the contract deletes only the approval for the new owner, not all approvals granted by the previous owner, so other approved addresses remain authorized.
**Steps:**
1. User A calls approve/transfer-approval for User B and User C
2. User B claims ownership; only B's approval is revoked
3. User B transfers ownership back to User A
4. User C calls claimOwnership and succeeds despite A never re-approving C
**How found:** Code review of the approval-revocation logic against its own comment stating approvals should be revoked to avoid unintended transfer allowance; noticed only a single mapping entry was deleted.
**Exploitation:** A previously approved but unrevoked address waits until ownership cycles back to the original owner, then claims ownership without fresh approval, taking control of the wallet.
**Insight:** When a contract comment promises to revoke 'approvals' on transfer, check whether the code deletes a single mapping slot versus all entries; stale per-owner approval mappings survive ownership round-trips.