Submission Details
Impact:
Likelihood:
MED-02: Missing Input Validation in changeFeeAddress()
MED-02: Missing Input Validation in changeFeeAddress()
Description
The changeFeeAddress() function allows the owner to set feeAddress to address(0). This would cause the 20% fee to be burned on every subsequent raffle.
// Root cause in the codebase with @> marks to highlight the relevant section
function changeFeeAddress(address newFeeAddress) external onlyOwner {
@> feeAddress = newFeeAddress; // No validation against address(0)
}
Risk
Likelihood:
Owner mistake or compromised key
Accidental zero address assignment
Impact:
20% of all future raffle proceeds permanently burned
Financial loss for protocol
Proof of Concept
// Owner accidentally calls:
puppyRaffle.changeFeeAddress(address(0));
// All future selectWinner() calls:
// feeAddress.call{value: fee}("") sends to address(0) - BURNED
Recommended Mitigation
function changeFeeAddress(address newFeeAddress) external onlyOwner {
+ require(newFeeAddress != address(0), "PuppyRaffle: Fee address cannot be zero");
feeAddress = newFeeAddress;
}
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.