code-423n4 / 2021-04-meebits-findings

0 stars 0 forks source link

No zero check on constructor inputs. #63

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

There is no zero-check on the input parameters when creating the contract Beebots. If any of them (_alpha, _beta, or _beneficiary) is provided as 0x0 accidentally, the contract has to be redeployed. Besides, losing funds is possible when minting tokens if _beneficiary is set to 0 (see line 387).

Proof of Concept

Referenced code: Beebots.sol#L204-L212 Beebots.sol#L387

Tools Used

None

Recommended Mitigation Steps

Add three zero-checks in the constructor (e.g., require(beta != address(0))) with proper error messages.