Root + Impact

Description

The set_customer_engine() function allows the owner to update the address of the CustomerEngine contract. This is a critical address, as it is used for all sales interactions.

The function is missing a check to ensure that the new _customer_engine address is not the zero address (0x00...00).

Risk

Likelihood: Low
The zero address check is a standard security practice. While the owner is a trusted entity, accidentally setting this critical address to the zero address would effectively disable all sales functionality. This is a denial-of-service (DoS) risk.

Impact: Low
The impact is limited to a DoS on the sales functionality. The owner can correct the mistake in a subsequent transaction. No funds are directly at risk.

Proof of Concept

1. Setup: Deploy contracts.

2. Attack: Owner calls set_customer_engine(0x00...00).

3. Result: All subsequent calls to trigger_demand() will fail because the raw_call to the zero address will either revert or behave unexpectedly, effectively halting the sales mechanism until the owner corrects the address.

Recommended Mitigation

Add a check to ensure the new address is not the zero address.