NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: low

[M-2] Missing address(0) Check for _usdc in Constructor

Author Revealed upon completion

Root + Impact

Description

  • The constructor stores _usdc as an immutable without any zero-address validation. If deployed with address(0) as the USDC address, all token operations (mintNft, buy, cancelListing, collectUsdcFromSelling, withdrawFees) revert, permanently bricking the contract since usdc is immutable and cannot be updated after deployment.

// src/NFTDealers.sol
constructor(
address _owner,
address _usdc,
...
) ERC721(_collectionName, _symbol) {
@> owner = _owner; // no zero-address check
@> usdc = IERC20(_usdc); // no zero-address check — immutable, unrecoverable
...
}

Risk

Likelihood:

  • Deployment scripts or manual deployment errors could pass address(0) for _usdc.

  • No pre-deployment validation exists in the contract itself.

Impact:

  • The contract is deployed and funded with collateral that can never be recovered.

  • All USDC-dependent functions revert permanently with no upgrade path.

Proof of Concept

The contract deploys successfully with address(0) as the USDC address. Every subsequent call that involves USDC reverts, and the state is permanently broken.

function testDeployWithZeroUsdc() public {
// Deploys successfully despite zero address
NFTDealers broken = new NFTDealers(owner, address(0), "Test", "TST", "", 20e6);
​
vm.prank(owner);
broken.revealCollection();
vm.prank(owner);
broken.whitelistWallet(userWithCash);
​
// Every USDC interaction reverts
vm.startPrank(userWithCash);
vm.expectRevert();
broken.mintNft();
vm.stopPrank();
}

Recommended Mitigation

Add zero-address guards for both _owner and _usdc in the constructor to catch misconfiguration at deploy time.

constructor(address _owner, address _usdc, ...) ERC721(_collectionName, _symbol) {
+ if (_owner == address(0)) revert InvalidAddress();
+ if (_usdc == address(0)) revert InvalidAddress();
owner = _owner;
usdc = IERC20(_usdc);
...
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!