# When changing addresses, use 2 step transfer and/or contract size and/or address 0x0 checks Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-L07 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description When changing important addresses, it's best to use additional safety measures to prevent wrong addresses from being set. When the address to change is guaranteed to be a smart ```solidity contract, a isContract check is very helpful. Another layer of protection is using 2 step address transfer, in which a pending role is set first and only then, from the pending role ``` account, it accepts the new role. ### Recommendation Check every address setter and use the mentioned patterns. ### Status Acknowledged with the following statement: The optimization identified is acknowledged by the Fuji team. However, as indicated the issue is of low severity. During Q3 we will be working on optimizations that will improve general patterns within our contracts. --- Related findings: - [When changing addresses, use 2 step transfer and/or address 0x0 checks](https://0xsimao.com/findings/glacier-changing-addresses-transfer-0x0): Glacier - [KeyringCoreV2Base could use a 2 step admin transfer mechanism](https://0xsimao.com/findings/keyring-ii-keyring-step-transfer-mechanism): Keyring Credentials - [Throughout code-base: missing address checks.](https://0xsimao.com/findings/maple-finance-iii-throughout-code-address-checks): Maple Finance - [BaseAssetManager missing 0 address checks in the constructor](https://0xsimao.com/findings/singularity-asset-address-checks-constructor): Singularity