First Flight #13: Baba Marta

Summary

Variables like _martenitsaMarketplace and _martenitsaVoting in HealthToken.sol is initialized as 0 and also could be 0 in a situation where any(or both) of the parameters in HealthToken.sol::setMarketAndVotingAddress is passed as 0 any time in the projects lifespan. The implication of this is that HealthToken.sol::distributeHealthToken which requires that the msg.sender is either _martenitsaMarketplace or _martenitsaVoting will be 0x0000000000000000000000000000000000000000(address zero) before HealthToken.sol::setMarketAndVotingAddress is called, and this can be a security flaw for the protocol.

Tools Used

Manual Review

Recommendations

Pass the address of variable _martenitsaMarketplace and _martenitsaVoting in a constructor to ensure its initialized as the contract is deployed and incase there is plan to change this address in the future, also ensure that there is a check which prevent both address from been address zero.