First Flight #2: Puppy Raffle

Summary

Vulnerability Details

The changeFeeAddress() function lacks a check for address zero. This means that an owner could call the function to change the fee address to address zero by mistake, and all fees would then be sent to address zero. This would effectively drain the contract of all of its fees to a null address.

Impact

The contract could be drained of all of its fee funds to address zero.

Users could lose money if they paying fees to the contract.

POC

https://gist.github.com/Falilah/c77222f98a8a7c656bfa974e508e7211

Tools Used

manual review, Foundry

Recommendations

The changeFeeAddress() function should be modified to check if the new fee address is address zero. If it is, the function should revert.