Submission Details
Severity:
Lack of validate address in the ZENO contract
Summary
In the ZENO contract, constructor not validate address of _usdc.
Vulnerability Details
In constructor does not check if _usdc is invalid.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/zeno/ZENO.sol#L20-L29
constructor(
address _usdc,
uint256 _maturityDate,
string memory _name,
string memory _symbol,
address _initialOwner
) Ownable(_initialOwner) ERC20(_name, _symbol) {
USDC = IERC20(_usdc);
MATURITY_DATE = _maturityDate;
}
If _usdc is set address not valid, this is affect to contract.
Impact
Affect to contract operation
Tools Used
manual
Recommendations
Add check require(_usdc != address(0), "Invalid USDC address");
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.