transferOwnership should be two step process

[code423n4]

Handle

JMukesh

Vulnerability details

Impact

Lack of two-step procedure for critical operations leaves them error-prone
if the address is incorrect, the new address will take on the functionality of the new role immediately

for Ex : -Alice deploys a new version of the whitehack group address. When she invokes the whitehack group address setter to replace the address, she accidentally enters the wrong address. The new address now has access to the role immediately and is too late to revert

https://raw.githubusercontent.com/trailofbits/publications/master/reviews/hermez.pdf

Proof of Concept

https://github.com/code-423n4/2021-08-notional/blob/4b51b0de2b448e4d36809781c097c7bc373312e9/contracts/external/actions/GovernanceAction.sol#L26

Tools Used

manual reveiw

Recommended Mitigation Steps

use a two-step procedure for all non-recoverable critical operations to prevent
irrecoverable mistakes.

[jeffywu]

Duplicate #94