Summary

Lack of zero address checks for function input values

Vulnerability Details

There are various critical functions especially initialization functions and setter functions that do not check that address inputs are not zero address

Impact

This can result in system not working as expected as it can lead to misconfiguration especially for the initialization functions e.g
depostToken many end up being address(0)
address[] calldata users_, for private pool user management may end up with address(0) skipping the actual user that was needed
setDistribution(distribution_); distribution address(0) may be passed in by error
Although above examples especially access controlled functions can be rerun to correct hence not critical but it still wastes gas, can be overlooked and actually cause problems

Tools Used

Manual Analysis

Recommendations

It is recommended to check that all addresses for critical functionality have the check that zero address can not be take in as a input