QA Report

[code423n4]

Default proof is returned when input is empty

Contract:
DNSSECImpl.sol

Description:

1. If submitRRSets function is called with an empty list of RRSets then no RRSet gets submitted.
2. Instead of throwing an error that input is empty, function simply the proof (The DNSKEY or DS) which was passed as argument

Recommendation:
Add below check

require(input.length>0, "No RRSET to submit");

---

2 step owner change

Contract:
Owned.sol

Description:
The setOwner function directly sets the new owner value passed without checking for 0 address or performing a 2 step change

Recommendation:
Add a zero address change.
Also add 2 step change for Admin which includes pendingAdmin inclusion

---

Use call instead of transfer

Contract
ETHRegistrarController.sol

Description
It was observed that withdraw function is using transfer function instead of call for transferring ether. This could become a problem if owner is contract and require more than 2300 gas (in which case transfer reverts)

Recommendation
Use call which does not have 2300 gas limitation

[jefflau]

Duplicate of #133