BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

missing zero address check for participationFeeAddress

sharmarahul991073

The constructor does not check zero address for _participationFeeAddress.

Description

The constructor accepts _participationFeeAddress but does not validate it against the zero address (address(0)). If the deployer accidentally passes address(0) (or a malicious deploy path allows it), any future participation fee transfers to participationFeeAddress will send tokens/ETH to the zero address and result in permanent loss (burn).

constructor(
IERC20 _asset,
uint256 _participationFeeBsp,
uint256 _eventStartDate,
address _participationFeeAddress,
uint256 _minimumAmount,
uint256 _eventEndDate
) ERC4626(_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX) {
revert limiteExceede();
}
@> // missing zero address check for participationFeeAddress
​
participationFeeBsp = _participationFeeBsp;
eventStartDate = _eventStartDate;
eventEndDate = _eventEndDate;
participationFeeAddress = _participationFeeAddress;
minimumAmount = _minimumAmount;
_setWinner = false;
}
​

Risk

Likelihood:

This will occur due to not checking for zero address.

Impact:

Funds intended as participation fees will be irrecoverably sent to address(0) (burned).

  • Loss of funds for participants and protocol; potential denial-of-service of fee-related flows.Proof of Concept

function testFeeBurnsWhenZeroAddress() public {
// deploy contract with participationFeeAddress = address(0)
BriVault v = new BriVault(asset, feeBsp, start, address(0), minAmount, end);
​
// simulate deposit from alice -> this will attempt to safeTransferFrom to address(0)
vm.prank(alice);
vm.expectRevert(); // or expect tokens to be burned depending on token behavior
v.deposit(amount, alice);
}
​

Recommended Mitigation

+if (_participationFeeAddress == address(0)) {
+ revert InvalidAddress(); //
+}
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!