First Flight #9: Soulmate

Summary

There are a few places where zero-address validations are missing.

Vulnerability Details

Improper initialization of the Vault with an incorrect managerContract value can result in a DOS, and a burn of the 500,000,000 LoveToken minted for the starting contract and Airdrop tokens, rendering the contract unusable. The same observation applies to the Staking contract constructor and the constructor of Airdrop.sol.

Impact

Tools Used

Slither and Manual Analysis

Proof of Concept:
see files

• Found in src/Airdrop.sol : constructor(ILoveToken _loveToken, ISoulmate _soulmateContract, IVault _airdropVault)

• Found in src/LoveToken.sol : constructor(ISoulmate _soulmateContract, address _airdropVault, address _stakingVault)

• Found in src/Staking.sol constructor(ILoveToken _loveToken, ISoulmate _soulmateContract, IVault _stakingVault)

• Found in src/Vault.sol : function initVault(ILoveToken loveToken, address managerContract)

Recommendations

For example, instead of pragma solidity ^0.8.0;, use pragma solidity 0.8.23;
Add require() to zero-address validate the address parameters