SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Missing address(0) validation in updateVerifier inconsistent with constructor

Author Revealed upon completion

Description

  • The constructor correctly validates the verifier address against address(0), but updateVerifier does not apply the same check, creating an inconsistency in input validation across the contract.

  • The owner could accidentally brick claim functionality by setting the verifier to address(0), requiring a follow-up updateVerifier call to recover.

// @> constructor correctly validates
if (_verifier == address(0)) revert InvalidVerifier();
​
// @> updateVerifier applies no equivalent check
function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
verifier = newVerifier; // @> no zero address check — address(0) accepted silently
}

Risk

Likelihood:

  • The missing zero address check is absent on every call to updateVerifier, meaning any invocation by the owner without explicit care can silently set the verifier to address(0).

  • The inconsistency with the constructor makes this easy to overlook during review or future modifications, as the protection exists in one path but not the other.

Impact:

  • The owner could accidentally brick claim functionality by setting the verifier to address(0), requiring a follow-up updateVerifier call to recover.

Proof of Concept

function test_updateVerifierCanBeSetToAddressZero() public {
vm.prank(owner);
hunt.pause();
​
// succeeds — no zero address validation
vm.prank(owner);
hunt.updateVerifier(IVerifier(address(0)));
​
// verifier is now address(0)
assertEq(hunt.getVerifier(), address(0), "verifier was set to address(0)");
}

Recommended Mitigation

function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
+ if (address(newVerifier) == address(0)) revert InvalidVerifier();
verifier = newVerifier;
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!