Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Missing Zero-Address Validation in StrataxOracle::getRoundData (Invalid Input + Defensive Programming Gap)

Author Revealed upon completion

Missing Zero-Address Validation in StrataxOracle::getRoundData (Invalid Input + Defensive Programming Gap)

Description:

The function StrataxOracle::getRoundData does not validate that _token is not the zero address before accessing the priceFeedsmapping. This allows unintended calls using address(0) and weakens input validation consistency across the contract.

@> address priceFeedAddress = priceFeeds[_token];
​

If _token == address(0), the function reads priceFeeds[address(0)], which may revert indirectly or behave unexpectedly if misconfigured.

Impact:

  • Allows accidental misuse of the function with address(0).

  • Weakens API guarantees for external integrations.

  • Inconsistent validation compared to best practices for external-facing functions.

  • Minor maintainability and correctness issue.

This is not a direct security vulnerability but reflects incomplete defensive validation.

Proof of Concept:

Calling:

getRoundData(address(0));
​

will attempt to read priceFeeds[address(0)], potentially:

  • Reverting with "Price feed not set for token", or

  • Succeeding if the zero address was mistakenly configured.

Recommended Mitigation:

Add an explicit zero-address check and migrate to custom errors for gas efficiency and consistency:

error ZeroTokenAddress();
error PriceFeedNotSet();
​
function getRoundData(address _token)
public
view
returns (
uint80 roundId,
int256 answer,
uint256 startedAt,
uint256 updatedAt,
uint80 answeredInRound
)
{
if (_token == address(0)) revert ZeroTokenAddress();
​
address priceFeedAddress = priceFeeds[_token];
if (priceFeedAddress == address(0)) revert PriceFeedNotSet();
​
AggregatorV3Interface priceFeed = AggregatorV3Interface(priceFeedAddress);
(roundId, answer, startedAt, updatedAt, answeredInRound) =
priceFeed.latestRoundData();
}
​

This ensures stronger input validation, improved consistency, and better gas efficiency across the contract.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!