Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

L-03 — Owner can set `feeAddress` to `address(0)` or redirect fees

rubabbel

Root + Impact

Description

changeFeeAddress accepts any address, including address(0), and the owner can
front-run a draw to redirect accumulated fees. Setting feeAddress to zero causes
withdrawFees to burn the ETH.

function changeFeeAddress(address newFeeAddress) external onlyOwner {
// @> No zero-address check; owner can also redirect fees at will
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}

Risk

Likelihood: Low — requires owner action/misconfiguration.

Impact: Low — accidental fee burn or centralization/trust concern over fee redirection.

Proof of Concept

function testFeeAddressZero() public {
puppyRaffle.changeFeeAddress(address(0));
assertEq(puppyRaffle.feeAddress(), address(0)); // fees would be burned on withdraw
}

Recommended Mitigation

Reject the zero address and consider a two-step change / timelock.

function changeFeeAddress(address newFeeAddress) external onlyOwner {
+ require(newFeeAddress != address(0), "PuppyRaffle: zero fee address");
+ require(newFeeAddress != feeAddress, "PuppyRaffle: same fee address");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 42 minutes ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!