Submission Details
Severity:
Missing zero address check in constructors
Summary
Missing zero address check in constructor for critical addresses can lead to failing functionality of the protocol and loss of funds.
Vulnerability Details
The following constructors are missing zero address checks.
/// WrappedTokenBridge.sol
constructor(
address _router,
address _linkToken,
address _token,
address _wrappedToken
) CCIPReceiver(_router) {...}
/// SDLPoolCCIPControllerPrimary
constructor(
address _router,
address _linkToken,
address _sdlToken,
address _sdlPool,
uint256 _maxLINKFee
) SDLPoolCCIPController(_router, _linkToken, _sdlToken, _sdlPool, _maxLINKFee) {}
/// SDLPoolCCIPController
constructor(
address _router,
address _linkToken,
address _sdlToken,
address _sdlPool,
uint256 _maxLINKFee
) CCIPReceiver(
/// RESDLTokenBridge
constructor(
address _linkToken,
address _sdlToken,
address _sdlPool,
address _sdlPoolCCIPController
) {
Impact
Failing functionality of the protocol across multiple functions
Tools Used
Manual review
Recommendations
Incorporate zero address checks across all constructors and a custom error following the same implementation of erros throughout the protocol. The existing custom error InvalidDestination() would be suitable; example implementation below.
error InvalidDestination();
...
/// SDLPoolCCIPController
constructor(
address _router,
address _linkToken,
address _sdlToken,
address _sdlPool,
uint256 _maxLINKFee
) CCIPReceiver(
) {
if (_router == address(0) || _linkToken == address(0) || _sdlToken == address(0) || _sdlPool == address(0)) revert InvalidDestination();
linkToken = IERC20(_linkToken);
sdlToken = IERC20(_sdlToken);
sdlPool = _sdlPool;
maxLINKFee = _maxLINKFee;
linkToken.approve(_router, type(uint256).max);
sdlToken.approve(_router, type(uint256).max);
}
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.