Check if variables are initialized

[code423n4]

Handle

pauliax

Vulnerability details

Impact

A variable named fairSideConviction is set in the contract FSD function setFairSideConviction. However, functions that use this variable do not check if it is already initialized. For example, function tokenizeConviction in contract ERC20ConvictionScore may transfer tokens to the 0x0 address: _transfer(msg.sender, address(fairSideConviction), locked); This will make these tokens inaccessible and basically burned. It would be better if the code explicitly checked before that address(fairSideConviction) != address(0). Rating this as low cuz I expect that in practice these variables will be initialized as soon as possible.

Also, this may be an additional small issue but I think it would make sense if functions setFairSideConviction and setFairSideNetwork do explicitly check that the parameter is not 0x0 address as theoretically it is possible to invoke these functions again and again when the address is empty.

Recommended Mitigation Steps

require address(fairSideConviction) != address(0) where this variable is used. Same can be applied to fsdNetwork variable.

[fairside-core]

This function is invoked directly in the deployment script and cannot be raced, as such, I think this should be set as non-critical (0).

[cemozerr]

Labeling this as low risk, as the issue could pose a problem in case the deployment script has a bug.