# When changing addresses, use 2 step transfer and/or address 0x0 checks Medium · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-L02 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description When changing important addresses, it's best to use additional safety measures to prevent wrong addresses from being set. One layer of protection is using 2 step address transfer, in which a pending role is set first and only then, from the pending role account, it accepts the new role. Safety measures were added to several of the functions that set addresses (checking if it is a contract). But for example the function [setNetworkWalletAddress()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/GlacierAddressBook.sol#L79) in GlacierAddressBook should have an extra security measure like 2 step transfer (since it can't use the isContract check). ### Status Currently being reviewed by the team. --- Related findings: - [When changing addresses, use 2 step transfer and/or contract size and/or address 0x0 checks](https://0xsimao.com/findings/fuji-finance-changing-addresses-transfer-0x0): Fuji Finance - [_to argument missing 0x0 address check in the ConnextRouter](https://0xsimao.com/findings/fuji-finance-argument-0x0-address-connext): Fuji Finance - [KeyringCoreV2Base could use a 2 step admin transfer mechanism](https://0xsimao.com/findings/keyring-ii-keyring-step-transfer-mechanism): Keyring Credentials - [Throughout code-base: missing address checks.](https://0xsimao.com/findings/maple-finance-iii-throughout-code-address-checks): Maple Finance