search

code-423n4 / 2022-01-livepeer-findings

0 stars 0 forks source link

Missing 0 address check #4

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

cccz

Vulnerability details

Impact

Missing 0 address check when setting address in contract

Proof of Concept

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/pool/DelegatorPool.sol#L48

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/gateway/L2LPTDataCache.sol#L30

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/gateway/L2LPTDataCache.sol#L38

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/gateway/L2LPTGateway.sol#L52

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/gateway/L2Migrator.sol#L86-L90

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/gateway/L2Migrator.sol#L101

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/gateway/L2Migrator.sol#L112

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L1/gateway/L1LPTDataCache.sol#L25-L26

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L1/gateway/L1LPTGateway.sol#L55

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L1/gateway/L1LPTGateway.sol#L64

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L1/gateway/L1Migrator.sol#L136-L141

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/ControlledGateway.sol#L22-L23

Tools Used

Manual analysis

Recommended Mitigation Steps

Add 0 address check

yondonfu commented 2 years ago

Not planning on adding these checks because the caller/deployer will be responsible for providing the correct addresses and noting that even if there is a zero address check in the contract, the caller/deployer is still the only one that is aware of the correct address to use.

0xleastwood commented 2 years ago

This is not an issue, so marking as non-critical.