SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`updateVerifier()` lacks the zero-address and contract-code validation the constructor performs, allowing the owner to brick all future claims

copperbramble

Scope: contracts/src/TreasureHunt.sol

Root + Impact

Description

The constructor guards against a zero verifier address:

constructor(address _verifier) payable {
if (_verifier == address(0)) revert InvalidVerifier();
...
verifier = IVerifier(_verifier);
...
}

But updateVerifier() has no equivalent sanity check:

function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
verifier = newVerifier; // @> no validation
emit VerifierUpdated(address(newVerifier));
}

An owner who fat-fingers a zero address (or points the contract at an
EOA or a non-conforming contract) silently replaces the verifier. The
emitted VerifierUpdated event still reports success. After
unpause(), every subsequent claim() reverts (either during the
external call, or because the verifier returns false), bricking the
hunt until the owner corrects the value.

Risk

Likelihood: MEDIUM — requires an owner-mistake, not an external
exploit; but the contract documents the owner as trusted, so
accidental misuse is the realistic concern.

Impact: LOW — no ETH is lost (owner can reset to the correct
verifier and resume, or emergencyWithdraw to recover); the hunt is
temporarily DoS'd.

Proof of Concept

vm.prank(owner);
hunt.pause();
vm.prank(owner);
hunt.updateVerifier(IVerifier(address(0))); // no revert; emits VerifierUpdated
vm.prank(owner);
hunt.unpause();
​
vm.prank(participant);
hunt.claim(proof, treasureHash, recipient); // reverts on verifier.verify()

Recommended Mitigation

Mirror the constructor's check:

function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
+ if (address(newVerifier) == address(0)) revert InvalidVerifier();
+ require(address(newVerifier).code.length > 0, "VERIFIER_NOT_CONTRACT");
verifier = newVerifier;
emit VerifierUpdated(address(newVerifier));
}

Disclosure

This finding was identified and written up with the assistance of an
autonomous AI auditor (Anthropic Claude).

Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

no zero-address check in updateVerifier()

The issue is that `updateVerifier()` allows the owner to replace the verifier with an arbitrary address, including `address(0)`, even though the constructor explicitly treats a zero verifier as invalid and reverts with `InvalidVerifier()` during initial deployment. In other words, the contract establishes at deployment time that a null verifier address is not an acceptable configuration, but then fails to preserve that same invariant when the verifier is later updated through the admin recovery path.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!