DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing zero address check in Ditto.sol

tychaios

Vulnerability Details

In Ditto.sol:16, there is no check to ensure that diamondAddr provided to the Ditto contract's constructor isn't the zero address. Given that the diamond address is used throughout the contract as a privileged entity (as seen in the onlyDiamond modifier), not verifying its integrity during the contract's initialization can lead to unforeseen consequences and potential misuse.

constructor(address diamondAddr) ERC20("Ditto", "DITTO") ERC20Permit("Ditto") {
diamond = diamondAddr;
}

Tools Used

Manual Review

Recommendations

Before assigning the value of diamondAddr to the diamond state variable in the constructor, a check should be inserted to ensure that diamondAddr is not the zero address. If it is, the constructor should revert.

This can be achieved with a simple check:

require(diamondAddr != address(0), "Ditto: diamondAddr cannot be zero address");
Updates

Lead Judging Commences

0xnevi Lead Judge
about 2 years ago
0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: Zero address checks

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.