BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: medium

Missing Contract Validation, That Is Allows Misconfiguration of Safe Harbor Registry Address

Author Revealed upon completion

Root + Impact

Description

  • The function validates only that the supplied address is non-zero.

  • It does not verify that the address contains deployed contract code.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Medium:

  • Although only the owner can call the function, administrative configuration mistakes are common during deployments, upgrades, or governance operations.

Impact:

  • The owner can mistakenly configure the Safe Harbor Registry to an Externally Owned Account (EOA) or an address without deployed code. Any protocol functionality that later interacts with the registry may revert, resulting in a partial or complete denial of service until the registry is corrected


Proof of Concept

This test clear us doubt and verify us this can be happen

​
​
​
POC
function test_PoC_SafeHarborRegistry_AcceptsEOA_NoCodeCheck() public {
address eoa = makeAddr("eoaAsRegistry");
assertEq(eoa.code.length, 0);
​
vm.prank(owner);
factory.setSafeHarborRegistry(eoa); // succeeds despite eoa having no code
​
assertEq(address(factory.safeHarborRegistry()), eoa);
}
​
​
​
​

Recommended Mitigation

Verify that the supplied address is a deployed contract before updating the registry


- remove this code
​
function setSafeHarborRegistry(address newSafeHarborRegistry) external onlyOwner {
if (newSafeHarborRegistry == address(0)) revert ZeroAddress();
address old = address(safeHarborRegistry);
safeHarborRegistry = IBattleChainSafeHarborRegistry(newSafeHarborRegistry);
emit SafeHarborRegistryUpdated(old, newSafeHarborRegistry);
}
​
+ add this code
​
function setSafeHarborRegistry(address newSafeHarborRegistry)
external
onlyOwner
{
if (newSafeHarborRegistry == address(0))
revert ZeroAddress();
​
if (newSafeHarborRegistry.code.length == 0)
revert NotAContract();
​
address old = address(safeHarborRegistry);
safeHarborRegistry = IBattleChainSafeHarborRegistry(newSafeHarborRegistry);
​
emit SafeHarborRegistryUpdated(old, newSafeHarborRegistry);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!