Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Oracle initializer accepts a zero pool-factory address, permanently bricking price lookups

sub99

Oracle initializer accepts a zero pool-factory address, permanently bricking price lookups

Description

__Oracle_init_unchained assigns the pool factory address with no validation, and ThunderLoan.initialize passes tswapAddress straight through. If address(0) is supplied, getPriceInWeth will always revert.

// OracleUpgradeable.sol:15-17
function __Oracle_init_unchained(address poolFactoryAddress) internal onlyInitializing {
s_poolFactory = poolFactoryAddress; // @> no zero-address check
}

Notably, AssetToken already guards its constructor with revertIfZeroAddress, so the oracle's omission is an inconsistency within the same codebase.

Risk

Likelihood:
Requires a deployment/initialization mistake (zero address passed at init). Low likelihood since it is a one-time owner action, but trivial to get wrong.

Impact:
Every call to getPriceInWeth reverts because IPoolFactory(address(0)).getPool fails, which breaks getCalculatedFee and therefore deposit and flashloan. Since initialize is initializer-guarded, it cannot be re-run to fix the value — the deployment is bricked.

Proof of Concept

Initialize with the zero address and observe price lookups revert.

function test_zeroFactoryBricksOracle() public {
ThunderLoan tl = new ThunderLoan();
tl.initialize(address(0)); // accepted, no revert
vm.expectRevert();
tl.getPriceInWeth(address(tokenA));
}

Recommended Mitigation

Reject the zero address during initialization, mirroring AssetToken.revertIfZeroAddress.

+ error Oracle__ZeroAddress();
function __Oracle_init_unchained(address poolFactoryAddress) internal onlyInitializing {
+ if (poolFactoryAddress == address(0)) {
+ revert Oracle__ZeroAddress();
+ }
s_poolFactory = poolFactoryAddress;
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!