Summary

Various negative problems may occur due to the lack of zero address check in the constructor() of the in-scope contracts and TempleGoldStaking.sol#stakeFor() functions.

Vulnerability Details

-The constructor() of the in-scope contracts

It's considered best practice to implement zero address checks to prevent accidents. Contracts would have to be redeployed if one of the critical addresses remains zero upon initialization.

https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/DaiGoldAuction.sol#L48-L58

As you can see, it does not check whether the treasury address is a zero address. As a result, the DAI token is sent to address (0) in the DaiGoldAuction.sol#bid() function, resulting in a loss of funds.

-TempleGoldStaking.sol#stakeFor()

Here too, the 'for' address is not checked to see if it is a 0 address. So, the staking token is staked to address(0) , and then the staker cannot withdraw their funds.

Impact

If the zero address check is failed, the core functions of the protocol may not be executed and funds may be transferred to address (0) and locked.

Tools Used

Manual Review

Recommendations

Consider to implement zero address checks to prevent accidents.