NFT Dealers
First Flight #58
Beginner FriendlyFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

Constructor Does Not Validate Critical Addresses Against `address(0)`

Author Revealed upon completion

Constructor Does Not Validate Critical Addresses Against address(0)

Description

The constructor sets critical addresses (owner and usdc) without validating that inputs are non-zero.

If _owner is address(0), owner-only administrative functionality becomes permanently inaccessible. If _usdc is address(0), ERC20 interactions (mint/list/buy/settlement flows) are misconfigured and can revert or behave unexpectedly.

constructor(
address _owner,
address _usdc,
string memory _collectionName,
string memory _symbol,
string memory _collectionImage,
uint256 _lockAmount
) ERC721(_collectionName, _symbol) {
owner = _owner;
usdc = IERC20(_usdc);
collectionName = _collectionName;
tokenSymbol = _symbol;
collectionImage = _collectionImage;
lockAmount = _lockAmount;
}

Risk

Likelihood:

  • The issue occurs at deployment time when constructor arguments are supplied.

  • Deployment scripts and manual deployments are common sources of parameter mistakes.

Impact:

  • owner = address(0) can permanently lock admin operations (onlyOwner).

  • usdc = address(0) breaks core protocol token flows and can render the system unusable.

Proof of Concept

  1. Deploy with _owner = address(0).

  2. Call any onlyOwner function (e.g., revealCollection()) from a regular account.

  3. Call reverts forever because no EOA can satisfy owner == msg.sender.

Alternative:

  1. Deploy with _usdc = address(0).

  2. Call mintNft() or buy().

  3. ERC20 call path is invalid due to a zero token address, causing core flows to fail.

Recommended Mitigation

Validate constructor inputs and revert on zero addresses.

constructor(
address _owner,
address _usdc,
string memory _collectionName,
string memory _symbol,
string memory _collectionImage,
uint256 _lockAmount
) ERC721(_collectionName, _symbol) {
+ if (_owner == address(0) || _usdc == address(0)) revert InvalidAddress();
+
owner = _owner;
usdc = IERC20(_usdc);
collectionName = _collectionName;
tokenSymbol = _symbol;
collectionImage = _collectionImage;
lockAmount = _lockAmount;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!