Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of zero address validation in `MysteryBox::changeOwner` function allows ownership to be set to null, leading to permanent loss of control over the contract

phylax

Summary

A zero address check is crucial in functions like changeOwner to prevent accidental or malicious assignment of critical roles, such as ownership, to an invalid address (address(0)). Although this function currently lacks access control, it should include access restrictions, making a zero address check essential to prevent ownership from being assigned to an invalid address.

Impact

If ownership is transferred to the zero address, the contract would effectively become ownerless, locking out essential functions that only the owner can execute. This could lead to permanent loss of control over the contract.

Tools Used

Manual code review and slither

Recommendations

Add zero address validation.

function changeOwner(address _newOwner) public {
+ require(_newOwner != address(0), "Invalid address: new owner cannot be the zero address");
owner = _newOwner;
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!