search

code-423n4 / 2021-09-wildcredit-findings

0 stars 0 forks source link

Lack of checks for addresses in `LendingPair.initialize` #111

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

GalloDaSballo

Vulnerability details

Impact

LendingPair Initializer: https://github.com/code-423n4/2021-09-wildcredit/blob/c48235289a25b2134bb16530185483e8c85507f8/contracts/LendingPair.sol#L85

Correctly checks for tokens not being address 0

However it doesn't check for _uniV3Helper nor _lendingController being different from address 0

Since the initializer can be called only one, it's best to ensure these are set sensibly

Recommended Mitigation Steps

Add checks to the initializer require(_uniV3Helper != address(0)); require(_feeRecipient != address(0));

talegift commented 2 years ago

Duplicate #110

ghoul-sol commented 2 years ago

per #110 invalid