Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Zero Address Check in Constructor of `ScrvusdVerifierV1.sol`

0xterrah

Summary

The constructors in both ScrvusdVerifierV1.sol and its child contract ScrvusdVerifierV2.sol do not validate that the provided oracle addresses are non-zero. This could lead to the deployment of non-functional contracts if zero addresses are accidentally provided.

Vulnerability Details

In ScrvusdVerifierV1.sol, the constructor accepts two address parameters and assigns them to immutable variables without verifying that they are not the zero address:

constructor(address _block_hash_oracle, address _scrvusd_oracle)
{
BLOCK_HASH_ORACLE = _block_hash_oracle;
SCRVUSD_ORACLE = _scrvusd_oracle;
}

If either _block_hash_oracle or _scrvusd_oracle is the zero address (0x0), the contract will be deployed with permanently invalid references, requiring redeployment.

Since ScrvusdVerifierV2.sol inherits from ScrvusdVerifierV1.sol and uses its constructor, it is also affected by this issue.

Impact

If deployed with a zero address for either oracle:

  • The contract would be non-functional from the start

  • Since the addresses are immutable, the contract would need to be redeployed

  • This would cause operational delay but no direct fund loss

The practical impact is limited since this issue would be detected immediately during deployment testing before the contract interacts with real assets.

Tools Used

Manual code review

Recommendations

Add zero address validation in the constructor:

constructor(address _block_hash_oracle, address _scrvusd_oracle) {
require(_block_hash_oracle != address(0), "Zero address for blockhash oracle");
require(_scrvusd_oracle != address(0), "Zero address for scrvusd oracle");
BLOCK_HASH_ORACLE = _block_hash_oracle;
SCRVUSD_ORACLE = _scrvusd_oracle;
}
Updates

Lead Judging Commences

0xnevi Lead Judge
8 months ago
0xnevi Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.