Root + Impact

Description

• The constructor takes an address parameter (likely for initial supply recipient or owner) but does not validate if it's the zero address.

• If deployed with address(0), all initial tokens will be minted to the burn address and become permanently lost.

Risk

Likelihood:

• Constructor uses the provided address directly without validation.

• High – anyone can intentionally or accidentally deploy with address(0)

Impact:

• High (entire initial supply lost forever)

• Permanent loss of entire initial token supply

• No way to recover tokens sent to address(0)

Proof of Concept

Recommended Mitigation