QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack Of Zero Address Validation in setETHUSDOracle function.

mathew20h

Summary

The setETHUSDOracle function in the UpdateWeightRunner contract allows an admin to update the address of the ETH/USD oracle. However, the function currently does not include a check to prevent the ethUsdOracle from being set to the zero address. This issue can lead to the contract failing to interact with an actual oracle, causing operational issues.

Affected Function:

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L304

The issue is located in the setETHUSDOracle function in the contract:

function setETHUSDOracle(address _ethUsdOracle) public {
require(msg.sender == quantammAdmin, "ONLYADMIN");
ethOracle = OracleWrapper(_ethUsdOracle);
emit ETHUSDOracleSet(_ethUsdOracle);
}

Vulnerability Details

  • Lack of Zero Address Protection: In the current implementation, the setETHUSDOracle function does not properly protect against the possibility of setting the ETHUSDOracle address to address(0). This issue occurs because there is no require statement, which is meant to prevent this, does not enforce the check at the point of call or with adequate clarity.

Impact

The absence of a valid ETHUSDoracle will cause price data to be unavailable, potentially locking up contract operations or causing incorrect behavior in contract interactions.

  • Operational Failure: The inability to fetch ETH/USD data would break any features in the contract that rely on this data.

Tools Used

Manually source code review.

Recommendations

Here is fixed version of this function:

function setETHUSDOracle(address _ethUsdOracle) public {
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_ethUsdOracle != address(0), "ETHUSD Oracle cannot be zero address");
ethOracle = OracleWrapper(_ethUsdOracle);
emit ETHUSDOracleSet(_ethUsdOracle);
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.