Summary

Missing zero address validation vulnerability in the provided contract. The vulnerability arises from not checking whether the provided address (newOwner) is zero before updating the owner in the updateOwner function.

Vulnerability Details

The vulnerability is present in the updateOwner function, where the newOwner address is not validated for being the zero address before updating the contract's owner. This could lead to unintended consequences, such as losing ownership of the contract if the updateOwner function is called without specifying a new owner.

Code snippet:

Impact

The impact of these vulnerabilities is dependent on the context in which the contract is used. If the zero address is unintentionally used as the wethAddress during deployment or if the to address is the zero address during a call to unwrapAndSendETH, it could lead to unexpected behavior, including failed transfers or unintended transfers to the zero address.

Tools Used

The vulnerability was detected using the Slither tool, specifically its missing zero address validation check.

Recommendations

To mitigate the identified vulnerabilities, the following recommendations are proposed:

Zero-Check in Constructor: Add a check in the constructor to ensure that the provided wethAddress is not the zero address before assigning it to the WETH state variable.

Zero-Check in unwrapAndSendETH: Add a check in the unwrapAndSendETH function to ensure that the provided to address is not the zero address before initiating the transfer.

Use require or revert: Instead of using throw, consider using require or revert for better readability and to conform with modern Solidity practices.

Example :