Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

No validation of `_contractOwner` in `Diamond:constructor`

0xbeastboy

Summary

Diamond:constructor is missing validation for the param _contractOwner, it can lead to several issues. Like owner can be set to 0 address which will revoke full admin access from owner. Also it can be set to a contract address which could be malicious too.

Vulnerability Details

See the following code:

constructor(address _contractOwner) {
LibDiamond.setContractOwner(_contractOwner);
LibDiamond.addDiamondFunctions(
address(new DiamondCutFacet()),
address(new DiamondLoupeFacet())
);
}

Impact

If zero address is set as contract owner it can disrupt the whole protocol functionality. All the owner functions wouldn't be accessible.

Tools Used

Manuall Review

Recommendations

Do proper validation of _contractOwner in Diamond:constructor, ensure that the owner is non-zero address.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.