GivingThanks
First Flight #28
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing zero-address check in `changeAdmin`

freesultan

Summary

The changeAdmin function in the CharityRegistry contract does not check if the provided address parameter is a valid, non-zero address before using it.

Vulnerability Details

In the changeAdmin function below, the admin could unintentionally call the function with a zero address, rendering the contract unmanageable afterward.

function changeAdmin(address newAdmin) public {
require(msg.sender == admin, "Only admin can change admin");
admin = newAdmin;
}

Impact

Although the likelihood of an admin accidentally setting a zero address is low, the impact is of medium severity. This vulnerability would disrupt the intended behavior of the CharityRegistry contract, preventing any charities from being verified.

Tools Used

Manual Review, Slither, Aderyn, Remix

Recommendations

Add a zero-address check for the newAdmin parameter:

function changeAdmin(address newAdmin) public {
require(msg.sender == admin, "Only admin can change admin");
+ require(newAdmin != address(0), "New admin cannot be the zero address");
admin = newAdmin;
}
​
Updates

Lead Judging Commences

n0kto Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.