Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Zero Address Checks In Constructor

w33ked

Summary

This report highlights a vulnerability in the StrategyMainnet.sol contract where address parameters in the constructor lack checks against the zero address, potentially leading to critical contract failures.

Vulnerability Details

  • Location: StrategyMainnet.sol, lines 27-38

  • Description: The constructor accepts addresses for _asset and _transmuter without validating that these are not the zero address (0x0). If these parameters are set to 0x0, it can lead to contract malfunction or loss of funds.

Impact

  • Contract Malfunction: A zero address in a key role like _asset or _transmuter cannot execute functions or interact as normal addresses, which can halt contract operations.

  • Irretrievable Funds: Any assets sent to the zero address are lost forever, potentially leading to financial loss for users or the protocol

Tools Used

Manual Review

Foundry

Recommendations

Implement zero address validation in the constructor.

constructor(
address _asset,
address _transmuter,
string memory _name
) BaseStrategy(_asset, _name) {
// Check if _asset is not the zero address
require(_asset != address(0), "Asset address cannot be zero");
// Check if _transmuter is not the zero address
require(_transmuter != address(0), "Transmuter address cannot be zero");
transmuter = ITransmuter(_transmuter);
require(transmuter.syntheticToken() == _asset, "Asset does not match transmuter synthetic token");
underlying = ERC20(transmuter.underlyingToken());
asset.safeApprove(address(transmuter), type(uint256).max);
_initStrategy();
}
Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.