Submission Details
Impact:
Likelihood:
Missing Zero-Address Validation
Author Revealed upon completion
Description:
The constructor assigns _link, _keeperRegistry, and _keeperRegistrar without zero-address checks, risking broken Chainlink integration.
constructor(...) {
s_link = _link; // @audit No zero check
s_keeperRegistry = _keeperRegistry;
s_keeperRegistrar = _keeperRegistrar;
...
}
Impact:
-
Zero addresses halt minting and automation, rendering the contract unusable.
-
Requires redeployment, wasting gas and funds.
Proof of Concept:
Deploy with
_link = address(0).requestMintWeatherNFTwith_registerKeeper = truereverts.
Proof of Code
function testZeroAddressLink() public {
vm.expectRevert("Invalid LINK address");
new WeatherNft(weathers, uris, router, config, 1 ether, 0.1 ether, address(0), registry, registrar, gasLimit);
}
Recommended Mitigation:
Add checks:
require(_link != address(0), "Invalid LINK address");
require(_keeperRegistry != address(0), "Invalid Keeper Registry");
require(_keeperRegistrar != address(0), "Invalid Keeper Registrar");
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
View preliminary resultsAppeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.