Submission Details
Severity:
`PuppyRaffle:: changeFeeAddress` Lack of input validation could lead to fund loss
Summary
changeFeeAddress function lacks of input validation. If an arbitrary address is set (like address (0)) then all collected fees will be lost forever.
Vulnerability Details
changeFeeAddress function allows owner to set any address as fees, which is not correct. If owner set address (0) or other arbitrary address by mistake, that will cause loss of fees.
Impact
Fees collected by protocol will lost.
Tools Used
Manual Review
Recommendations
Add a check for zero address. Carefully double check the address before setting a new address as fee receiver.
+ require (newFeeAddress != address(0), "Zero address is not allowed");
function changeFeeAddress(address newFeeAddress) external onlyOwner {
require (newFeeAddress != address(0), "Zero address is not allowed");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.