BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Participation Fee Address Zero Check Missing

drmanhattan852

[L-5] Participation Fee Address Zero Check Missing

Description

The contract doesn't validate that the _participationFeeAddress is non-zero, potentially allowing fees to be permanently lost if set to the zero address.

constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
// No validation for _participationFeeAddress
participationFeeAddress = _participationFeeAddress;
// ...
}

Risk

Likelihood:

  • Constructor parameter validation missing in deployment code

Common developer oversight when handling address parameters

Impact:

  • All participation fees permanently lost by being sent to address(0)

Protocol revenue intended for fee collection becomes unrecoverable

Proof of Concept

Deploy contract with zero address for fee collection parameter, resulting in all fees being permanently burned when users deposit.

// Deploy with zero address for fee collection
BriVault vault = new BriVault(
asset,
100, // fee
startDate,
address(0), // fee address set to zero address
minimumAmount,
endDate
);
​
// Result: All participation fees sent to address(0) and permanently lost

Recommended Mitigation

Add a require statement or error in the constructor to validate that _participationFeeAddress != address(0).

constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
// ...
require(_participationFeeAddress != address(0), "Fee address cannot be zero");
participationFeeAddress = _participationFeeAddress;
// ...
}
Updates

Appeal created

bube Lead Judge 20 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!