Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Zero Address Validation of `sequencerUptimeFeedAddresses`

akay

Summary

Looking at the configureSequencerUptimeFeedByChainId function, it lacks validation to prevent zero addresses from being set as sequencerUptimeFeedAddresses. This oversight could lead to security risks and system inconsistencies.

Vulnerability Details

In the configureSequencerUptimeFeedByChainId function, there is no check to ensure that the provided sequencerUptimeFeedAddresses are not zero addresses. It allows any address, including the zero address to be set as a sequencer uptime feed for a given chain ID.

for (uint256 i; i < chainIds.length; i++) {
globalConfiguration.sequencerUptimeFeedByChainId[chainIds[i]] = sequencerUptimeFeedAddresses[i];
emit LogSetSequencerUptimeFeed(msg.sender, chainIds[i], sequencerUptimeFeedAddresses[i]);
}

Impact

Zero addresses set as sequencer uptime feeds could lead to unexpected behavior in dependent systems. Also, the system might accept invalid configurations, leading to hard-to-debug issues.

Tools Used

Manual code review

Recommendations

Implement a zero address check of the sequenceUptimeFeedAddresses within the configureSequencerUptimeFeedByChainId function

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.