Submission Details
Impact:
Likelihood:
Missing Zero-Address Validation
Description:
The constructor assigns _link, _keeperRegistry, and _keeperRegistrar without zero-address checks, risking broken Chainlink integration.
constructor(...) {
s_link = _link; // @audit No zero check
s_keeperRegistry = _keeperRegistry;
s_keeperRegistrar = _keeperRegistrar;
...
}
Impact:
-
Zero addresses halt minting and automation, rendering the contract unusable.
-
Requires redeployment, wasting gas and funds.
Proof of Concept:
Deploy with
_link = address(0).requestMintWeatherNFTwith_registerKeeper = truereverts.
Proof of Code
function testZeroAddressLink() public {
vm.expectRevert("Invalid LINK address");
new WeatherNft(weathers, uris, router, config, 1 ether, 0.1 ether, address(0), registry, registrar, gasLimit);
}
Recommended Mitigation:
Add checks:
require(_link != address(0), "Invalid LINK address");
require(_keeperRegistry != address(0), "Invalid Keeper Registry");
require(_keeperRegistrar != address(0), "Invalid Keeper Registrar");
Rewards breakdown
nSLOC
236This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.