RocketStorage - Risk concentration by giving all registered contracts permissions to change any settings in RocketStorage  Acknowledged
The ACL for changing settings in the centralized `RocketStorage` allows any registered contract (listed under contract.exists) to change settings that belong to other parts of the system.\\nThe concern is that if someone finds a way to add their malicious contract to the registered contact list, they will override any setting in the system. The storage is authoritative when checking certain ACLs. Being able to set any value might allow an attacker to gain control of the complete system. Allowing any contract to overwrite other contracts' settings dramatically increases the attack surface.\\n```\\nmodifier onlyLatestRocketNetworkContract() {\\n    // The owner and other contracts are only allowed to set the storage upon deployment to register the initial contracts/settings, afterwards their direct access is disabled\\n    if (boolStorage[keccak256(abi.encodePacked("contract.storage.initialised"))] == true) {\\n        // Make sure the access is permitted to only contracts in our Dapp\\n        require(boolStorage[keccak256(abi.encodePacked("contract.exists", msg.sender))], "Invalid or outdated network contract");\\n    }\\n    \\_;\\n}\\n```\\n\\n```\\nfunction setAddress(bytes32 \\_key, address \\_value) onlyLatestRocketNetworkContract override external {\\n    addressStorage[\\_key] = \\_value;\\n}\\n\\n/// @param \\_key The key for the record\\nfunction setUint(bytes32 \\_key, uint \\_value) onlyLatestRocketNetworkContract override external {\\n    uIntStorage[\\_key] = \\_value;\\n}\\n```\\n
Resolution\\nThe client provided the following statement:\\nWe've looked at adding access control contracts using namespaces, but the increase in gas usage would be significant and could hinder upgrades.\\nAllow contracts to only change settings related to their namespace.
```\\nmodifier onlyLatestRocketNetworkContract() {\\n    // The owner and other contracts are only allowed to set the storage upon deployment to register the initial contracts/settings, afterwards their direct access is disabled\\n    if (boolStorage[keccak256(abi.encodePacked("contract.storage.initialised"))] == true) {\\n        // Make sure the access is permitted to only contracts in our Dapp\\n        require(boolStorage[keccak256(abi.encodePacked("contract.exists", msg.sender))], "Invalid or outdated network contract");\\n    }\\n    \\_;\\n}\\n```\\n