DittoETH

Vulnerability Details

• Vulnerability ID: M-09

• File/Line: Asset.sol:14

• Short Description: No check for diamondAddr not being the zero address.

• Code Snippet:

  contract Asset is ERC20 {

  address private immutable diamond;

  ​

  error NotDiamond();

  ​

  constructor(address diamondAddr, string memory name, string memory symbol)

  ERC20(name, symbol)

  {

  diamond = diamondAddr;

  }

  ​

  modifier onlyDiamond() {

  if (msg.sender != diamond) {

  revert NotDiamond();

  }

  _;

  }

  ​

  function mint(address to, uint256 amount) external onlyDiamond {

  // ...

  }

Impact

Any instantiation of the Asset contract might unknowingly set the diamond address to the zero address. This could lead to potential mishandling of functions restricted by the onlyDiamond modifier since the zero address cannot initiate transactions.

Tools Used

Manual Review

Recommendations

Implement a check in the constructor to ensure that diamondAddr is not the zero address.