stake.link

Summary

The RESDLTokenBridge contract is designed to handle the transfer of reSDL NFTs between primary and secondary chains. There is a potential vulnerability in the constructor, where it does not validate parameters for zero address checks.

Vulnerability Details

The constructor of the RESDLTokenBridge contract does not perform zero address checks for the input parameters (_linkToken, _sdlToken, _sdlPool, _sdlPoolCCIPController). This could lead to unintended issues, such as initializing the contract with invalid or zero addresses.

Code Snippet

Impact

If the constructor is called with zero or invalid addresses, it could result in unexpected behavior and potential vulnerabilities in the contract. This may lead to a compromise of the bridge's functionality and pose a risk to the security of the overall system.

Tools Used

Manual review.

Recommendations

Zero Address Validation: Add explicit zero address validation checks in the constructor for all input parameters to ensure that the contract is not initialized with invalid addresses.

Input Validation Standardization: Consider implementing a standardized input validation approach across the contract to enhance overall security and reduce the risk of potential vulnerabilities.

It is recommended to address these issues promptly to enhance the security and reliability of the RESDLTokenBridge contract.