Submission Details
Severity:
Missing zero address check in ExitShortFacet can set cusd to zero
Vulnerability Details
M-04: Lack of Validation for _cusd Address
In ExitShortFacet.sol:30, the constructor of the contract assigns the passed _cusd address directly to the cusd state variable without validating if it is the zero address.
constructor(address _cusd) {
cusd = _cusd;
}
Impact
Setting the zero address for critical contract dependencies like _cusd could halt operations and cause potential loss of funds.
Tools Used
Manual Review
Recommendations
Implement a check in the constructor to ensure that the _cusd address is not the zero address before assignment.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.