Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Missing Zero-Address Validation for `feeAddress` in Constructor and Setter Can Result in Burned Fees

farhandavin14

[L-01] Missing Zero-Address Validation for feeAddress in Constructor and Setter Can Result in Burned Fees

Description

  • The deployer and owner initialize and update feeAddress to direct where protocol revenue is sent during withdrawFees().

  • Neither the constructor nor changeFeeAddress() verifies that the supplied address is non-zero. A zero address input causes subsequent fee withdrawals to send ETH directly to address(0).

constructor(uint256 _entranceFee, address _feeAddress, uint256 _raffleDuration) ERC721("Puppy Raffle", "PR") {
entranceFee = _entranceFee;
@> feeAddress = _feeAddress;
raffleDuration = _raffleDuration;
raffleStartTime = block.timestamp;
...
}
​
function changeFeeAddress(address newFeeAddress) external onlyOwner {
@> feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}

Risk

Likelihood:

  • Accidental deployment or transaction submission with address(0) as the parameter due to input error or uninitialized variable.

Impact:

  • Protocol revenue is sent to address(0), permanently burning ETH with no recovery possible.

Proof of Concept

function test_setFeeAddressZero() public {
puppyRaffle.changeFeeAddress(address(0));
assertEq(puppyRaffle.feeAddress(), address(0));
}

Recommended Mitigation

constructor(uint256 _entranceFee, address _feeAddress, uint256 _raffleDuration) ERC721("Puppy Raffle", "PR") {
+ require(_feeAddress != address(0), "PuppyRaffle: feeAddress cannot be zero");
entranceFee = _entranceFee;
feeAddress = _feeAddress;
...
}
​
function changeFeeAddress(address newFeeAddress) external onlyOwner {
+ require(newFeeAddress != address(0), "PuppyRaffle: feeAddress cannot be zero");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!