Submission Details
Severity:
No check if usdc is correct or zero address, no way to change it either
Summary
no checks if _usdc is address(0) or any other incorrect one
Vulnerability Details
should check for address(0) for _usdc since there is no way to change it later
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/zeno/ZENO.sol#L20-L29
constructor(
address _usdc,
uint256 _maturityDate,
string memory _name,
string memory _symbol,
address _initialOwner
) Ownable(_initialOwner) ERC20(_name, _symbol) {
USDC = IERC20(_usdc);
MATURITY_DATE = _maturityDate;
}
Impact
dev can't change this later if set wrong
Tools Used
manual
Recommendations
check for the correct address and not address(0)
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.