SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Missing address(0) validation in updateVerifier inconsistent with constructor

web3pavlou

Description

  • The constructor correctly validates the verifier address against address(0), but updateVerifier does not apply the same check, creating an inconsistency in input validation across the contract.

  • The owner could accidentally brick claim functionality by setting the verifier to address(0), requiring a follow-up updateVerifier call to recover.

// @> constructor correctly validates
if (_verifier == address(0)) revert InvalidVerifier();
​
// @> updateVerifier applies no equivalent check
function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
verifier = newVerifier; // @> no zero address check — address(0) accepted silently
}

Risk

Likelihood:

  • The missing zero address check is absent on every call to updateVerifier, meaning any invocation by the owner without explicit care can silently set the verifier to address(0).

  • The inconsistency with the constructor makes this easy to overlook during review or future modifications, as the protection exists in one path but not the other.

Impact:

  • The owner could accidentally brick claim functionality by setting the verifier to address(0), requiring a follow-up updateVerifier call to recover.

Proof of Concept

function test_updateVerifierCanBeSetToAddressZero() public {
vm.prank(owner);
hunt.pause();
​
// succeeds — no zero address validation
vm.prank(owner);
hunt.updateVerifier(IVerifier(address(0)));
​
// verifier is now address(0)
assertEq(hunt.getVerifier(), address(0), "verifier was set to address(0)");
}

Recommended Mitigation

function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
+ if (address(newVerifier) == address(0)) revert InvalidVerifier();
verifier = newVerifier;
}
Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

no zero-address check in updateVerifier()

The issue is that `updateVerifier()` allows the owner to replace the verifier with an arbitrary address, including `address(0)`, even though the constructor explicitly treats a zero verifier as invalid and reverts with `InvalidVerifier()` during initial deployment. In other words, the contract establishes at deployment time that a null verifier address is not an acceptable configuration, but then fails to preserve that same invariant when the verifier is later updated through the admin recovery path.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!