DittoETH

Vulnerability Details

M-03: Zero Address Check Missing for Constructor Parameters

In BridgeRouterFacet.sol:28, there are no checks in place to ensure that _rethBridge or _stethBridge parameters passed to the constructor are not the zero address.

Snippet:

Impact

If the zero address is passed for either _rethBridge or _stethBridge, this could lead to erroneous behavior and potential loss of funds.

Tools Used

Manual Review

Recommendations

• Immediate Action: Add a check in the constructor that reverts the transaction if either _rethBridge or _stethBridge is the zero address.

  Suggested code:

  require(_rethBridge != address(0), "rethBridge cannot be zero address");

  require(_stethBridge != address(0), "stethBridge cannot be zero address");