NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[M-2] Missing address(0) Check for _usdc in Constructor

altshar

Root + Impact

Description

  • The constructor stores _usdc as an immutable without any zero-address validation. If deployed with address(0) as the USDC address, all token operations (mintNft, buy, cancelListing, collectUsdcFromSelling, withdrawFees) revert, permanently bricking the contract since usdc is immutable and cannot be updated after deployment.

// src/NFTDealers.sol
constructor(
address _owner,
address _usdc,
...
) ERC721(_collectionName, _symbol) {
@> owner = _owner; // no zero-address check
@> usdc = IERC20(_usdc); // no zero-address check — immutable, unrecoverable
...
}

Risk

Likelihood:

  • Deployment scripts or manual deployment errors could pass address(0) for _usdc.

  • No pre-deployment validation exists in the contract itself.

Impact:

  • The contract is deployed and funded with collateral that can never be recovered.

  • All USDC-dependent functions revert permanently with no upgrade path.

Proof of Concept

The contract deploys successfully with address(0) as the USDC address. Every subsequent call that involves USDC reverts, and the state is permanently broken.

function testDeployWithZeroUsdc() public {
// Deploys successfully despite zero address
NFTDealers broken = new NFTDealers(owner, address(0), "Test", "TST", "", 20e6);
​
vm.prank(owner);
broken.revealCollection();
vm.prank(owner);
broken.whitelistWallet(userWithCash);
​
// Every USDC interaction reverts
vm.startPrank(userWithCash);
vm.expectRevert();
broken.mintNft();
vm.stopPrank();
}

Recommended Mitigation

Add zero-address guards for both _owner and _usdc in the constructor to catch misconfiguration at deploy time.

constructor(address _owner, address _usdc, ...) ERC721(_collectionName, _symbol) {
+ if (_owner == address(0)) revert InvalidAddress();
+ if (_usdc == address(0)) revert InvalidAddress();
owner = _owner;
usdc = IERC20(_usdc);
...
}
Updates

Lead Judging Commences

rubik0n Lead Judge 16 days ago
Submission Judgement Published
Validated
Assigned finding tags:

no-zero-address-check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!