The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Checks for Zero Address in Solidity Smart Contracts

albahaca

Summary

This report identifies a common vulnerability in solidity smart contracts, where the address state variables are not checked for the zero address (address(0x0)) when assigning values to them. This could allow an attacker to set the address variables to zero and cause unexpected behaviors or errors in the contract logic.

Vulnerability Details

The address state variables are used to store the addresses of other contracts or accounts that interact with the contract. However, some of the functions that assign values to these variables do not check if the input address is valid or not.

107 function setBurnFeeRate(uint256 _rate) external onlyOwner {
burnFeeRate = _rate;
}
​
function setSwapFeeRate(uint256 _rate) external onlyOwner {
swapFeeRate = _rate;
}
​
function setWethAddress(address _weth) external onlyOwner() {
weth = _weth;
}
​
function setSwapRouter2(address _swapRouter) external onlyOwner() {
swapRouter2 = _swapRouter;
}
​
function setNFTMetadataGenerator(address _nftMetadataGenerator) external onlyOwner() {
nftMetadataGenerator = _nftMetadataGenerator;
}
​
function setSmartVaultDeployer(address _smartVaultDeployer) external onlyOwner() {
smartVaultDeployer = _smartVaultDeployer;
}
​
function setProtocolAddress(address _protocol) external onlyOwner() {
protocol = _protocol;
}
​
function setLiquidatorAddress(address _liquidator) external onlyOwner() {
liquidator = _liquidator;
}
​

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPoolManager.sol#L107-L137

37 owner = _owner;
​
234 owner = _newOwner;

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/SmartVaultV3.sol#L37

Impact

The impact of this vulnerability is a loss of functionality or security for the contract, as the contract will not be able to interact with the other contracts or accounts that are stored in the address variables. This could affect the liquidity, solvency, and integrity of the contract and its users.

Tools Used

Manul

Recommendations

The recommendations to fix this vulnerability are:

  • Add a require statement to check if the input address is not zero before assigning it to the address variable. For example:

require(_tokenManager != address(0), "TokenManager address cannot be zero");
tokenManager = _tokenManager;

  • Use the OpenZeppelin Address library to validate the input address using the isContract function. For example:

require(Address.isContract(_tokenManager), "TokenManager address must be a contract");
tokenManager = _tokenManager;
​
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.