Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Zero Address Validation in GlobalConfigurationBranch::initialize Function

ayoashy

Summary

The GlobalConfigurationBranch::initialize function lacks zero address validation for the tradingAccountToken and usdToken parameters. This vulnerability allows these crucial protocol addresses to be potentially set to the zero address during initialization. Given that this function is likely to be called only once due to its initializer modifier, setting either of these addresses to zero could lead to permanent impairment of core protocol functionalities.

Vulnerability Details

The GlobalConfigurationBranch::initialize function does not validate the tradingAccountToken and usdToken addresses for zero values. This lack of validation means that these addresses could be set to a zero address, which can potentially disrupt the intended functionality of the protocol. The affected code is as follows:

/// @dev The Ownable contract is initialized at the UpgradeBranch.
/// @dev {GlobalConfigurationBranch} UUPS initializer.
function initialize(address tradingAccountToken, address usdToken) external initializer {
GlobalConfiguration.Data storage globalConfiguration = GlobalConfiguration.load();
globalConfiguration.tradingAccountToken = tradingAccountToken;
globalConfiguration.usdToken = usdToken;
}
​

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/GlobalConfigurationBranch.sol#L133-L140

Impact

  • Setting tradingAccountToken or usdToken to a zero address can disrupt the protocol's operations, as these addresses are likely critical for token-related functionalities.

  • A zero address for these tokens would mean that the contract cannot interact with these tokens, leading to failures in functions that depend on them.

Tools Used

Manual Review

Recommendations

Implement zero address checks for both tradingAccountToken and usdToken parameters. Add the following checks at the beginning of the initialize function:

function initialize(address tradingAccountToken, address usdToken) external initializer {
if (tradingAccountToken == address(0)) {
revert Errors.ZeroInput("tradingAccountToken");
}
if (usdToken == address(0)) {
revert Errors.ZeroInput("usdToken");
}
GlobalConfiguration.Data storage globalConfiguration = GlobalConfiguration.load();
globalConfiguration.tradingAccountToken = tradingAccountToken;
globalConfiguration.usdToken = usdToken;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.