Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Zero Address Validation in Constructor Enables Permanent Oracle Failure

brene

Summary

The ScrvusdVerifierV1 contract's constructor lacks zero address validation for critical oracle addresses (_block_hash_oracle and _scrvusd_oracle). Once set, these immutable addresses cannot be changed, and if initialized with zero addresses, would permanently break the contract's core functionality.

Vulnerability Details

The constructor accepts two critical address parameters, assigns them directly to immutable variables, performs no validation on the input addresses and cannot be modified after deployment due to immutability

constructor(address _block_hash_oracle, address _scrvusd_oracle)
{
BLOCK_HASH_ORACLE = _block_hash_oracle;
SCRVUSD_ORACLE = _scrvusd_oracle;
}

These addresses are used in core functions:

function verifyScrvusdByBlockHash(...) external returns (uint256) {
require(
block_header.hash == IBlockHashOracle(BLOCK_HASH_ORACLE).get_block_hash(...),
"Blockhash mismatch"
);
...
}
​
function _updatePrice(...) internal returns (uint256) {
return IScrvusdOracle(SCRVUSD_ORACLE).update_price(params, ts, number);
}

Impact

If deployed with zero addresses, contract becomes permanently unusable and there will be no way to update addresses due to immutability therefore it would require new contract deployment

Tools Used

Manual Review

Recommendations

Add zero address check in the constructor

constructor(address _block_hash_oracle, address _scrvusd_oracle) {
+ require(_block_hash_oracle != address(0), "Zero block hash oracle address");
+ require(_scrvusd_oracle != address(0), "Zero scrvUSD oracle address");
BLOCK_HASH_ORACLE = _block_hash_oracle;
SCRVUSD_ORACLE = _scrvusd_oracle;
}
Updates

Lead Judging Commences

0xnevi Lead Judge
3 months ago
0xnevi Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.