Submission Details
Severity:
No Zero Address Checks in the Constructor parameters (initialAdmin and initialNFTDescriptor parameters) of SablierFlow contract
Summary
No Zero Address Checks in the Constructor in SablierFlow (initialAdmin and initialNFTDescriptor parameters)
Vulnerability Details
contract SablierFlow is
......................
constructor(
address initialAdmin,
IFlowNFTDescriptor initialNFTDescriptor
)
ERC721("Sablier Flow NFT", "SAB-FLOW")
SablierFlowBase(initialAdmin, initialNFTDescriptor)
@>> { }
Impact
There will be no admin in the protocol. Also the initialNFTDescriptor will be zero making tokenURI return an empty string .
Tools Used
Manual Review
Recommendations
Add a zero address checks in the constructor.
In the
https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/SablierFlow.sol#L39-L47
constructor(
// @ audit check the initialAdmin is not Address 0
// @ audit add a zero Address check to initialAdmin
address initialAdmin,
IFlowNFTDescriptor initialNFTDescriptor
)
ERC721("Sablier Flow NFT", "SAB-FLOW")
SablierFlowBase(initialAdmin, initialNFTDescriptor)
{
+ if (initialAdmin == address(0) && address(initialNFTDescriptor) == address(0)) {
+ revert();
}
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.