First Flight #2: Puppy Raffle

Summary

Lack of Validation for 'newFeeAddress' in 'changeFeeAddress' Function

Vulnerability Details

The 'changeFeeAddress' function currently lacks a crucial validation step to ensure that the 'newFeeAddress' provided is not the zero address (0x0) or a known dead address (e.g., 0x000...dead). Without this check, there is a risk of inadvertently setting the fee collection address to an unusable or incorrect address.

Impact

If the fee address is mistakenly set to a zero or dead address, all subsequent fees directed to this address would be irretrievably lost. This error could lead to significant financial loss and diminish trust in the smart contract's reliability.

Tools Used

Manual review

Recommendations

require(newFeeAddress != address(0), "Cannot set fee address to the zero address");
require(newFeeAddress != deadAddress, "Cannot set fee address to the dead address");