Tadle

Summary

The constructor for setting the guardian address in the `TadleFactory.sol` lacks zero address validation and the absence of a mechanism to update the guardian address in the future.

Vulnerability Details

In the constructor, the guardian address is set directly without any checks to ensure it is a valid, non-zero address. Additionally, there is no mechanism in place to update the guardian address after the contract has been deployed.

Affected LoC:

• https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L40-L42

Impact

If the constructor is called with a zero address as the guardian, the contract will be left with an invalid guardian, preventing any authorized user from calling the deployUpgradeableProxy function. This would hinder the deployment of upgradeable proxies, as no valid guardian would exist to perform this critical action.

Tools Used

Manual

Recommendations

To mitigate this issue, it is essential to include a validation check in the constructor to ensure that the guardian address is not set to the zero address.