Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Missing Zero-Address Validation in StrataxOracle::getRoundData (Invalid Input + Defensive Programming Gap)

sbb

Missing Zero-Address Validation in StrataxOracle::getRoundData (Invalid Input + Defensive Programming Gap)

Description:

The function StrataxOracle::getRoundData does not validate that _token is not the zero address before accessing the priceFeedsmapping. This allows unintended calls using address(0) and weakens input validation consistency across the contract.

@> address priceFeedAddress = priceFeeds[_token];
​

If _token == address(0), the function reads priceFeeds[address(0)], which may revert indirectly or behave unexpectedly if misconfigured.

Impact:

  • Allows accidental misuse of the function with address(0).

  • Weakens API guarantees for external integrations.

  • Inconsistent validation compared to best practices for external-facing functions.

  • Minor maintainability and correctness issue.

This is not a direct security vulnerability but reflects incomplete defensive validation.

Proof of Concept:

Calling:

getRoundData(address(0));
​

will attempt to read priceFeeds[address(0)], potentially:

  • Reverting with "Price feed not set for token", or

  • Succeeding if the zero address was mistakenly configured.

Recommended Mitigation:

Add an explicit zero-address check and migrate to custom errors for gas efficiency and consistency:

error ZeroTokenAddress();
error PriceFeedNotSet();
​
function getRoundData(address _token)
public
view
returns (
uint80 roundId,
int256 answer,
uint256 startedAt,
uint256 updatedAt,
uint80 answeredInRound
)
{
if (_token == address(0)) revert ZeroTokenAddress();
​
address priceFeedAddress = priceFeeds[_token];
if (priceFeedAddress == address(0)) revert PriceFeedNotSet();
​
AggregatorV3Interface priceFeed = AggregatorV3Interface(priceFeedAddress);
(roundId, answer, startedAt, updatedAt, answeredInRound) =
priceFeed.latestRoundData();
}
​

This ensures stronger input validation, improved consistency, and better gas efficiency across the contract.

Updates

Lead Judging Commences

izuman Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!