TITLE (Non-Input validation can lead to no-owner contracts and have to re-deploy)
There is no input validation so the address of msg.sender is not 0. Generally projects do leave un-initialized variables to start, but in this case would cause a re-deployment and loss of gas because the only way to update the owner is via the following function:
Input validation has to be done in all constructors from all contracts. I just pointed this one out, but should be done in all constructors. Check the fix below
SEVERITY (either high or medium, see the rules)
Medium, not very likely, but can cost loss of gas if happens and re-deployments
TITLE (Non-Input validation can lead to no-owner contracts and have to re-deploy)
There is no input validation so the address of msg.sender is not 0. Generally projects do leave un-initialized variables to start, but in this case would cause a re-deployment and loss of gas because the only way to update the owner is via the following function:
https://github.com/LodestarFinance/lodestar-protocol/blob/807a166179ca5be52039d39316844d2a420eabce/contracts/Oracle/SushiOracle.sol#L50
which is impossible if the owner is address(0).
Input validation has to be done in all constructors from all contracts. I just pointed this one out, but should be done in all constructors. Check the fix below
SEVERITY (either high or medium, see the rules)
Medium, not very likely, but can cost loss of gas if happens and re-deployments
A LINK TO THE GITHUB ISSUE
https://github.com/LodestarFinance/lodestar-protocol/blob/807a166179ca5be52039d39316844d2a420eabce/contracts/Oracle/SushiOracle.sol#L23-L27
SOLUTION
Add input validation: