Submission Details
Severity:
Zero Address Check Missing in setRouter()
Summary
The setRouter function in StrategyOp.sol and StrategyArb.sol lacks a zero address validation check when setting a new router address.
Vulnerability Details
function setRouter(address _router) external onlyManagement {
router = _router;
underlying.safeApprove(router, type(uint256).max);
}
The function allows setting the router address to address(0) without any validation.
Impact
If the router address is accidentally set to zero:
Token swapping functionality would be temporarily broken
Additional transaction would be needed to fix the issue
Recommendations
Add a zero address validation check at the beginning of the function:
function setRouter(address _router) external onlyManagement {
+ require(_router != address(0), "Zero address not allowed");
router = _router;
underlying.safeApprove(router, type(uint256).max);
}
This check will prevent potential operational issues and follows smart contract security best practices.
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366
OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.