A flaw in the Rattadan Cosmowarp smart contract allows a comparison to an unintended value of the current_admin variable. This defect can lead to an administrator view being granted to an attacker, enabling them to perform privileged actions such as contract configuration, asset registry manipulation, or other high‑privilege operations. The weakness corresponds to CWE-1025, exposing a serious authority abuse flaw. Without the correct check, any user could potentially assume administrator status, compromising the integrity of the contract and the safety of its assets.

The vulnerability exists in the Cosmowarp contract released by Rattadan, affecting all deployments prior to commit 56c6147. The affected code resides in asset_registry/src/contract.rs around line 343, where the current_admin comparator is incorrectly used.

The CVSS score of 8.4 indicates high severity, and the lack of an EPSS score reflects insufficient data on exploitation probability but does not diminish the critical nature of the flaw. The issue is not listed in CISA's KEV catalog, implying it has not yet been observed in the wild. The likely attack vector is through on‑chain transaction injections that target the admin comparison check, allowing a malicious actor to set an arbitrary address as current_admin and gain administrative control. Immediate patching is strongly recommended to mitigate the risk of unauthorized privilege escalation.