Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Zero Address Check in ShipmentPlanner.sol

kevinkkien

Summary

The ShipmentPlanner.sol contract in the Beanstalk project lacks a check for the zero address for the beanstalkAddress parameter in the constructor function. This can lead to errors if beanstalkAddress is the zero address, causing transactions to revert when calling other functions in the contract.

Vulnerability Details

The ShipmentPlanner.sol contract uses a beanstalk variable of type IBeanstalk to interact with the main Beanstalk contract. This variable is initialized in the constructor with the beanstalkAddress that is passed in. However, the constructor does not check if beanstalkAddress is the zero address.

constructor(address beanstalkAddress) {
beanstalk = IBeanstalk(beanstalkAddress);
}

If beanstalkAddress is the zero address, the beanstalk variable will point to a non-existent contract. When other functions in ShipmentPlanner.sol (such as getBarnPlan and getFieldPlan) call functions of beanstalk, the transaction will revert with an error "call to non-contract".

Impact

If a user calls the getBarnPlan or getFieldPlan functions after the ShipmentPlanner.sol contract is initialized with beanstalkAddress as the zero address, the transaction will revert, causing the user to waste gas.

Tools Used

Manual Code Review

Recommendations

require check should be added to the constructor to ensure that beanstalkAddress is not the zero address:

constructor(address beanstalkAddress) {
require(beanstalkAddress != address(0), "Invalid Beanstalk address"); // Add check
beanstalk = IBeanstalk(beanstalkAddress);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.