GivingThanks

Root Cause and Impact

• Root Cause: The changeAdmin function lacks a check to prevent the new admin from being set to the zero address.

• Impact: The contract could become irreversibly locked without an admin, preventing administrative functions from being executed.

Vulnerability Details

• Code Snippet:

  function changeAdmin(address newAdmin) public {

  require(msg.sender == admin, "Only admin can change admin");

  admin = newAdmin;

  }

  • Issue: No validation of newAdmin.

  • Consequence: Setting admin to address(0) could disable admin functionalities.

Recommendations

• Add Validation for newAdmin:

  require(newAdmin != address(0), "New admin cannot be zero address");

• Consider Emitting an Event:

  • Emit an event to log admin changes:

    event AdminChanged(address indexed previousAdmin, address indexed newAdmin);

    ​

    function changeAdmin(address newAdmin) public {

    require(msg.sender == admin, "Only admin can change admin");

    require(newAdmin != address(0), "New admin cannot be zero address");

    emit AdminChanged(admin, newAdmin);

    admin = newAdmin;

    }