Submission Details
Severity:
Missing zero address check in VaultFacet
Vulnerability Details
In VaultFacet.sol:27, the constructor initializes the carbonZeth immutable variable with the _zeth address provided as a parameter. However, there is no check to ensure that the _zeth address is not the zero address.
constructor(address _zeth) {
carbonZeth = _zeth;
}
Impact
By failing to check if _zeth is the zero address, there is a potential risk of funds being accidentally. This can lead to permanent loss of funds as the zero address is non-recoverable.
Tools Used
Manual Review
Recommendations
Before assigning the value of _zeth to carbonZeth, implement a check to ensure that _zeth is not the zero address.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.