Submission Details
Impact:
Likelihood:
Missing zero address check in constructor
Root + Impact
Description
-
The constructor takes an address parameter (likely for initial supply recipient or owner) but does not validate if it's the zero address.
-
If deployed with address(0), all initial tokens will be minted to the burn address and become permanently lost.
Constructor uses the address parameter directly without validation:
require(recipient != address(0), "Zero address");
Risk
Likelihood:
-
Constructor uses the provided address directly without validation.
-
High – anyone can intentionally or accidentally deploy with address(0)
Impact:
-
High (entire initial supply lost forever)
-
Permanent loss of entire initial token supply
-
No way to recover tokens sent to address(0)
Proof of Concept
Deploy the contract passing address(0) as constructor argument
All tokens are minted to 0x000...000
Tokens are lost forever
Recommended Mitigation
Add in constructor:
require(initialRecipient != address(0), "Zero address not allowed");
Rewards breakdown
nSLOC
222This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.