Weather Witness
First Flight #40
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Missing Zero-Address Validation

ym419974

Description:
The constructor assigns _link, _keeperRegistry, and _keeperRegistrar without zero-address checks, risking broken Chainlink integration.

constructor(...) {
s_link = _link; // @audit No zero check
s_keeperRegistry = _keeperRegistry;
s_keeperRegistrar = _keeperRegistrar;
...
}

Impact:

  • Zero addresses halt minting and automation, rendering the contract unusable.

  • Requires redeployment, wasting gas and funds.

Proof of Concept:

  1. Deploy with _link = address(0).

  2. requestMintWeatherNFT with _registerKeeper = true reverts.

Proof of Code
function testZeroAddressLink() public {
vm.expectRevert("Invalid LINK address");
new WeatherNft(weathers, uris, router, config, 1 ether, 0.1 ether, address(0), registry, registrar, gasLimit);
}

Recommended Mitigation:
Add checks:

require(_link != address(0), "Invalid LINK address");
require(_keeperRegistry != address(0), "Invalid Keeper Registry");
require(_keeperRegistrar != address(0), "Invalid Keeper Registrar");
Updates

Appeal created

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.