Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Missing Zero-Address Validation on Critical Functions

jufel

Description:
The contract’s constructor and two functions accept address parameters without checking for the zero address (address(0)). Specifically:

  • The constructor assigns _beatToken and calls setOrganizer(_organizer) without validating that these inputs are non-zero.

  • setOrganizer(address _organizer) allows the owner to set the organizer to address(0).

  • withdraw(address target) allows the owner to send contract funds to address(0), effectively burning Ether.

Impact:

  • Permanent Loss of Funds: Calling withdraw(address(0)) will send Ether to the zero address, irreversibly locking the contract’s entire balance.

  • Broken Contract Logic: Setting organizer to zero disables all organizer-restricted functionality, potentially bricking parts of the contract.

  • Misconfigured Token Integration: Assigning the beatToken address to zero nullifies all token interactions, breaking token minting and burning.

Mitigation:

  • Enforce Non-Zero Checks: Add require statements for all external address inputs:

constructor(address _beatToken, address _organizer) ... {
require(_beatToken != address(0), "BeatToken cannot be zero address");
require(_organizer != address(0), "Organizer cannot be zero address");
setOrganizer(_organizer);
beatToken = _beatToken;
}
​
function setOrganizer(address _organizer) public onlyOwner {
require(_organizer != address(0), "Organizer cannot be zero address");
...
}
​
function withdraw(address target) external onlyOwner {
require(target != address(0), "Target cannot be zero address");
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 26 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Zero address check

Owner/admin is trusted / Zero address check - Informational

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.