Submission Details
Severity:
Missing Zero Address Check in changeOwner() Function Can Lead to Permanent Loss of Contract Control
## Summary
The `changeOwner()` function allows the contract owner to transfer ownership to another address. However, the function does not include a check to prevent transferring ownership to the zero address (`0x0000000000000000000000000000000000000000`). Allowing this could result in the contract becoming orphaned, where no one has control over it, leading to potential loss of management capabilities.
## Vulnerability Details
The current implementation of the `changeOwner()` function does not verify whether the `_newOwner` address is the zero address. As a result, ownership could be transferred to the zero address, effectively making the contract ownerless, as no one controls the zero address. This would lock the contract from future management actions, including the ability to withdraw funds, set parameters, or execute owner-only operations.
Here is the current implementation of the `changeOwner()` function:
```solidity
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
```
## Impact
• Loss of Contract Control: If ownership is transferred to the zero address, the contract will become effectively ownerless, and no one will be able to perform owner-specific actions such as withdrawing funds or modifying parameters.
• Irreversible: Once ownership is transferred to the zero address, it cannot be reclaimed or changed, effectively locking the contract’s functionality.
## Tools Used
• Manual code review
##Recommendations
Make the following change to mitigate this issue.
```diff
function changeOwner(address _newOwner) public {
+ require(_newOwner != address(0), "New owner cannot be the zero address");
owner = _newOwner;
}
```
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.