Root + Impact

Description

The Vyper language provides a built-in constant ZERO_ADDRESS for checking against the null address. The codebase uses this constant in some places but relies on a literal empty(address) check in others.

For example, in Cyfrin_Hub.vy:

• The customer_engine state variable is checked using empty(self.customer_engine).

Using inconsistent methods for checking the zero address can lead to confusion, maintainability issues, and potential errors if the literal check is ever incorrectly implemented.

Risk

Likelihood: Low
The current implementation using empty(address) is functionally correct in Vyper.

Impact: Low
This is primarily a code quality and maintainability issue. It does not pose a direct security risk but violates the principle of least astonishment and consistent code style.

Proof of Concept

This is a code style issue. The current code is:

The preferred, more explicit style is:

Recommended Mitigation

Replace all instances of empty(address) with a comparison against the built-in ZERO_ADDRESS constant for consistency and clarity.