DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing zero address check in MarginCallPrimaryFacet can set cusd to zero

tychaios

Vulnerability Details

In MarginCallPrimaryFacet.sol:30, the constructor of the contract sets the cusd address using the _cusd parameter. However, there is no check ensuring that _cusd is not the zero address.

Snippet:

...
address private immutable cusd;
​
constructor(address _cusd) {
cusd = _cusd;
}

Impact

If the _cusd address is mistakenly set to the zero address, it could cause various functionalities of the contract that rely on the cusd address to malfunction.

Tools Used

Manual Review

Recommendations

It is strongly recommended to add a check in the constructor to ensure that _cusd is not the zero address. This can be achieved with a simple require statement:

require(_cusd != address(0), "CUSD address cannot be the zero address");

By adding this check, it will prevent the contract from being deployed with an invalid cusd address.

Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Zero address checks

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.