Submission Details
Severity:
L2MessageReceiver::setParams lacks zero address check breaks contract functionality
Summary
L2MessageReceiver::setParams lacks zero address check breaks contract functionality if zero address is used in rewardToken variable because other methods such as lzReceive and retryMessage will always revert
Vulnerability Details
If zero address is passed as rewardToken_
function setParams(address rewardToken_, Config calldata config_) external onlyOwner {
rewardToken = rewardToken_;
config = config_;
}
Then will break _nonblockingLzReceive function
function _nonblockingLzReceive(
uint16 senderChainId_,
bytes memory senderAndReceiverAddresses_,
bytes memory payload_
) private {
//...
IMOR(rewardToken).mint(user_, amount_);
}
Because it will try to cast zero address as MOR token contract and mint,
So the following functions will always revert, callgraph:
function lzReceive(
_blockingLzReceive(
nonblockingLzReceive
_nonblockingLzReceive
retryMessage
_nonblockingLzReceive
Impact
Denial of Service breaking contract functionality
Tools Used
Manual review
Recommendations
Implement a zero address check on L2MessageReceiver::setParams
function setParams(address rewardToken_, Config calldata config_) external onlyOwner {
require(rewardToken != address(0), "L1S: invalid rewardToken");
rewardToken = rewardToken_;
config = config_;
}
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.