SetOwner is an internal helper that was exported by mistake (should be setOwner). Without the pre-mutation readonly check, a cross-realm caller could call SetOwner + recover to silently hijack ownership in memory, then call TransferToken to steal funds.
gnokey query vm/qeval -remote "https://api.gno.berty.io:443" -data "gno.land/r/tests/vm/crossrealm_e.SetOwner()"# WARNING: This command is running in an INSECURE mode.
# It is strongly recommended to use a hardware device for signing
# and avoid trusting any computer connected to the internet,
# as your private keys could be exposed.
gnokey maketx call -pkgpath "gno.land/r/tests/vm/crossrealm_e" -func "TransferOwnership" -args $'' -gas-fee 1000000ugnot -gas-wanted 1_000_000_000 -send "" -chainid "dev" -remote "https://api.gno.berty.io:443" ADDRESSgnokey query -remote "https://api.gno.berty.io:443" auth/accounts/ADDRESS
gnokey maketx call -pkgpath "gno.land/r/tests/vm/crossrealm_e" -func "TransferOwnership" -args $'' -gas-fee 1000000ugnot -gas-wanted 1_000_000_000 -send "" -broadcast=false ADDRESS > call.tx
gnokey sign -tx-path call.tx -chainid "dev" -account-number ACCOUNTNUMBER -account-sequence SEQUENCENUMBER ADDRESS
gnokey broadcast -remote "https://api.gno.berty.io:443" call.tx
# WARNING: This command is running in an INSECURE mode.
# It is strongly recommended to use a hardware device for signing
# and avoid trusting any computer connected to the internet,
# as your private keys could be exposed.
gnokey maketx call -pkgpath "gno.land/r/tests/vm/crossrealm_e" -func "TransferToken" -gas-fee 1000000ugnot -gas-wanted 1_000_000_000 -send "" -chainid "dev" -remote "https://api.gno.berty.io:443" ADDRESSgnokey query -remote "https://api.gno.berty.io:443" auth/accounts/ADDRESS
gnokey maketx call -pkgpath "gno.land/r/tests/vm/crossrealm_e" -func "TransferToken" -gas-fee 1000000ugnot -gas-wanted 1_000_000_000 -send "" -broadcast=false ADDRESS > call.tx
gnokey sign -tx-path call.tx -chainid "dev" -account-number ACCOUNTNUMBER -account-sequence SEQUENCENUMBER ADDRESS
gnokey broadcast -remote "https://api.gno.berty.io:443" call.tx