Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Missing zero address checks for `feeAddress` can lead to lost fees.

gush

Root + Impact

Description

  • Both the constructor and `changeFeeAddress()` allow `feeAddress = address(0)`.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • When feeAddress is address(0).

Impact:

  • Fees can be sent to the zero address (effectively burned).

Proof of Concept

Place the following test into `PuppyRaffleTest.t.sol`.
​
```solidity
function test_feeAddressZero_burnsWithdrawnFees() public {
// Deploy with feeAddress = address(0)
PuppyRaffle raffle = new PuppyRaffle(1 ether, address(0), 0);
​
address[] memory players = new address[](4);
players[0] = address(1);
players[1] = address(2);
players[2] = address(3);
players[3] = address(4);
​
vm.deal(address(this), 4 ether);
raffle.enterRaffle{value: 4 ether}(players);
raffle.selectWinner();
​
uint256 zeroBefore = address(0).balance;
raffle.withdrawFees();
​
// 20% of 4 ether = 0.8 ether is sent to address(0)
assertEq(address(0).balance, zeroBefore + 0.8 ether);
}
```

Recommended Mitigation

Add `address(0)` checks in both constructor and `changeFeeAddress()`.
​
```diff
constructor(uint256 _entranceFee, address _feeAddress, uint256 _raffleDuration) ERC721("Puppy Raffle", "PR") {
entranceFee = _entranceFee;
+ require(_feeAddress != address(0), "PuppyRaffle: feeAddress cannot be zero");
feeAddress = _feeAddress;
raffleDuration = _raffleDuration;
raffleStartTime = block.timestamp;
}
@@
function changeFeeAddress(address newFeeAddress) external onlyOwner {
+ require(newFeeAddress != address(0), "PuppyRaffle: feeAddress cannot be zero");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
```
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!