SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing Zero Address Check for Verifier Update

gz627

Root + Impact

Description

  • updateVerifiershould update the Verifier with a valid non-zero contract address.

  • The updateVerifier function does not validate that the new verifier address is not zero.

// @>TreasureHunt.updateVerifier()
/// @notice In case of a bug, allow the owner to update the verifier address.
function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
verifier = newVerifier; // No zero address check!
​
emit VerifierUpdated(address(newVerifier));
}
​

Risk

Likelihood:

  • Reason 1: Owner could accidentally set verifier to address(0)

  • Reason 2: Owner could maliciously set verifier to address(0)

Impact:

  • Impact 1: This would brick the contract permanently as no valid proofs could be verified.

  • Impact 2: Claims would always fail.

Proof of Concept

When the owner accidentally set verifier to address(0), following claims would always fail.

// The owner updates the verifier:
TreasureHunt.pause();
TreasureHunt.updateVerifier(address(0));
TreasureHunt.unpause();
// any subsequent claims will fail
// a participent discovers a Treasure
// sumit a valid reward claim
// the claim fails

Recommended Mitigation

Add non-zero-address verification to `TreasureHunt.updateVerifier()`.

// @>TreasureHunt.updateVerifier()
/// @notice In case of a bug, allow the owner to update the verifier address.
function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
+ require(address(newVerifier) != address(0), "InvalidVerifier");
verifier = newVerifier; // No zero address check!
​
emit VerifierUpdated(address(newVerifier));
}
​
Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

no zero-address check in updateVerifier()

The issue is that `updateVerifier()` allows the owner to replace the verifier with an arbitrary address, including `address(0)`, even though the constructor explicitly treats a zero verifier as invalid and reverts with `InvalidVerifier()` during initial deployment. In other words, the contract establishes at deployment time that a null verifier address is not an acceptable configuration, but then fails to preserve that same invariant when the verifier is later updated through the admin recovery path.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!