Submission Details
Severity:
Check for (0) address in changeFeeAddress() - funds can be locked
Summary
changeFeeAddress() function does not check for the (0) address. Any withdrawal of those funds can be locked forever.
Vulnerability Details
If the owner accidentally changes the 'feeAddress' to the zero address (0x0) anybody can call the withdrawFees() function sending that ETH to the zero address where it is gone forever.
Impact
Medium - Funds can be lost but it is only by Owner oversight
Tools Used
Manual Inspection
Recommendations
Add a simple check like so (2nd line here):
function changeFeeAddress(address newFeeAddress) external onlyOwner {
require(newFeeAddress != address(0), "PuppyRaffle: do not use 0x0 address");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.