First Flight #2: Puppy Raffle

Summary

changeFeeAddress should be a 2-step process

Vulnerability Details

feeAddress should be changed in a 2-step process, wherein first the address is set to a temporary global variable and then the new feeAddress account calls the function changeFeeAddress to claim the ownership.

This way we are sure that someone has access to the private key of the feeAddress account.

Also, there is no check for input of zero address in the changeFeeAddress function.

Impact

An incorrect address can lead to fees being stuck forever.

Tools Used

Manual

Recommendations

Make it a 2-step process.