SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Lacking zero address check on updating verifier

akovachev7

Root + Impact

Description

  • When attempting to update the verifier to a zero address, the protocol should revert with `InvalidVerifier` custom error; otherwise, the claim functionality of the contract will always revert


function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
//@audit The new verifier should not be the zero address or the current verifier.
@> verifier = newVerifier;
​
emit VerifierUpdated(address(newVerifier));
}

Risk

Likelihood:

  • Low: When the owner attempts to update the verifier with the zero address


Impact:

  • High: If updated to the zero address, each call to the verify function of the Verifierwill revert blocking the claiming reward functionality of the protocol

Proof of Concept


  • The owner pauses the contract

  • The owner updates the verifier to the zero address

  • The owner unpauses the contract

function testUpdateVerifierToZeroAddressSuccess() public {
vm.startPrank(owner);
hunt.pause();
hunt.updateVerifier(IVerifier(address(0)));
hunt.unpause();
vm.stopPrank();
​
assertEq(address(hunt.getVerifier()), address(0));
}

Recommended Mitigation

  • Add a zero address check, which reverts with InvalidVerifier custom error

function updateVerifier(IVerifier newVerifier) external {
require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
require(msg.sender == owner, "ONLY_OWNER_CAN_UPDATE_VERIFIER");
+ if (address(newVerifier) == address(0) || address(newVerifier) == address(verifier)) {
+ revert InvalidVerifier();
+ }
verifier = newVerifier;
​
emit VerifierUpdated(address(newVerifier));
}
Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

no zero-address check in updateVerifier()

The issue is that `updateVerifier()` allows the owner to replace the verifier with an arbitrary address, including `address(0)`, even though the constructor explicitly treats a zero verifier as invalid and reverts with `InvalidVerifier()` during initial deployment. In other words, the contract establishes at deployment time that a null verifier address is not an acceptable configuration, but then fails to preserve that same invariant when the verifier is later updated through the admin recovery path.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!