First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

changeFeeAddress() lacking address zero-check makes it possible to loose fees

Oozman

PoC for constructor() lacking address zero-check

Summary

The PuppyRaffle::changeFeeAddress() function lacks a zero-check for newFeeAddress.

Vulnerability Details

The constructor does not check wether the newFeeAddress is different from 0 upon deployment.

Such a case would mean that 20% of the fees would be lost forever upon raffle selectWinner() and withdrawFees() completion.

Impact

MEDIUM IMPACT:

20% of the fees would be lost. It's not a hacking/stealing money case scenario, just a bad handling of money.

LOW LIKELYHOOD:

Constructor is only called once, while deploying. An owner who would accidentally input 0x0000000000000000000000000000000000000000 as a new fee address in quite unlikely.

Tools Used

  • VScode

  • Slither

Recommendations

  1. Add a require into the constructor like so:

function changeFeeAddress(address newFeeAddress) external onlyOwner {
+ require(newFeeAddress != address(0), "Fee address cannot be the zero address");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Zero address checks

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.