SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: low

Missing Zero Address Check for Verifier Update

Author Revealed upon completion

Root + Impact

Description

  • updateVerifiershould update the Verifier with a valid non-zero contract address.

  • The updateVerifier function does not validate that the new verifier address is not zero.

// @>TreasureHunt.updateVerifier()
/// @notice In case of a bug, allow the owner to update the verifier address.
function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
verifier = newVerifier; // No zero address check!
​
emit VerifierUpdated(address(newVerifier));
}
​

Risk

Likelihood:

  • Reason 1: Owner could accidentally set verifier to address(0)

  • Reason 2: Owner could maliciously set verifier to address(0)

Impact:

  • Impact 1: This would brick the contract permanently as no valid proofs could be verified.

  • Impact 2: Claims would always fail.

Proof of Concept

When the owner accidentally set verifier to address(0), following claims would always fail.

// The owner updates the verifier:
TreasureHunt.pause();
TreasureHunt.updateVerifier(address(0));
TreasureHunt.unpause();
// any subsequent claims will fail
// a participent discovers a Treasure
// sumit a valid reward claim
// the claim fails

Recommended Mitigation

Add non-zero-address verification to `TreasureHunt.updateVerifier()`.

// @>TreasureHunt.updateVerifier()
/// @notice In case of a bug, allow the owner to update the verifier address.
function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
+ require(address(newVerifier) != address(0), "InvalidVerifier");
verifier = newVerifier; // No zero address check!
​
emit VerifierUpdated(address(newVerifier));
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!