// ❌ 취약한 컨트랙트 — 접근 제어 없음 contract VulnerableVault { address public owner; constructor() { owner = msg.sender; } // ❌ 누구나 호출 가능 — modifier 없음! function changeOwner(address newOwner) public { owner = newOwner; } // ❌ owner 체크를 우회 당함 function adminWithdraw() public { uint bal = address(this).balance; require(bal > 0, "Empty"); payable(msg.sender).transfer(bal); } }

// ✅ 방어된 컨트랙트 — 2-step 소유권 이전 contract SecureVault { address public owner; address public pendingOwner; modifier onlyOwner() { require(msg.sender == owner, "Not owner"); _; } // ✅ onlyOwner → 현재 owner만 호출 가능 function transferOwnership(address newOwner) public onlyOwner { require(newOwner != address(0)); pendingOwner = newOwner; } // ✅ 새 owner가 직접 수락해야 완료 function acceptOwnership() public { require(msg.sender == pendingOwner, "Not pending"); owner = pendingOwner; pendingOwner = address(0); } }