Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of address(0) check in many function in the `VaultControllerStrategy` contract.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L696

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L706

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L715

Summary

Missing `address(0) checks.

Vulnerability Details

The VaultControllerStrategy::setVaultImplementation , VaultControllerStrategy::setFundFlowController and VaultControllerStrategy::setVaultDepositController functions, each take as a parameter a variable of type address, during which no check is made on the value that will be stored; therefore any address can be passed, including `address(0)`, which is generally an invalid address.

- VaultControllerStrategy::setVaultImplementation function :

function setVaultImplementation(address _vaultImplementation) external onlyOwner {
// @audit missing address(0) check
vaultImplementation = _vaultImplementation;
emit SetVaultImplementation(_vaultImplementation);
}

- VaultControllerStrategy::setFundFlowController function :

function setFundFlowController(address _fundFlowController) external onlyOwner {
// @audit missing address(0) check
fundFlowController = IFundFlowController(_fundFlowController);
}

- VaultControllerStrategy::setVaultDepositController function :

function setVaultDepositController(address _vaultDepositController) external onlyOwner {
// @audit lack of address(0) check
vaultDepositController = _vaultDepositController;
}

Impact

Unexpected and potentially risky behaviour that can be exploited by an attacker.

Tools Used

Manual analysis.

Recommendations

- VaultControllerStrategy::setVaultImplementation function :

function setVaultImplementation(address _vaultImplementation) external onlyOwner {
+ require( _vaultImplementation != address(0), "Invalid address!");
vaultImplementation = _vaultImplementation;
emit SetVaultImplementation(_vaultImplementation);
}

- VaultControllerStrategy::setFundFlowController function :

function setFundFlowController(address _fundFlowController) external onlyOwner {
+ require( _fundFlowController != address(0), "Invalid address!");
fundFlowController = IFundFlowController(_fundFlowController);
}

- VaultControllerStrategy::setVaultDepositController function :

function setVaultDepositController(address _vaultDepositController) external onlyOwner {
+ require( _vaultDepositController != address(0), "Invalid address!");
vaultDepositController = _vaultDepositController;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.