Puppy Raffle
AI First Flight #1
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

changeFeeAddress() accepts the zero address, which would burn all withdrawn fees

niosoke

Root + Impact

Neither the constructor nor changeFeeAddress() validates that the fee address is not address(0). If the owner ever sets the fee address to the zero address (typo or bad automation), withdrawFees() will still "succeed", because a plain call to the zero address does not revert, and the accumulated protocol fees are sent to address(0) and effectively burned.

Description

function changeFeeAddress(address newFeeAddress) external onlyOwner {
// @> feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}

Risk

Likelihood: Low - requires an owner mistake; the function is onlyOwner.
Impact: Low - only the protocol's own fees are at risk, but the loss is irreversible once withdrawFees() runs.

Proof of Concept

// puppyRaffle.changeFeeAddress(address(0));
// after a raffle completes, withdrawFees() succeeds and the fees end up at address(0):
// assertEq(feeAddressBalanceBefore, 0); // nothing recoverable

Recommended Mitigation

Reject the zero address in both the constructor and changeFeeAddress():

function changeFeeAddress(address newFeeAddress) external onlyOwner {
+ require(newFeeAddress != address(0), "PuppyRaffle: Fee address cannot be zero");
feeAddress = newFeeAddress;
emit FeeAddressChanged(newFeeAddress);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 4 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!