code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

Missing zero address check #250

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0v3rf10w

Vulnerability details

Impact

Lack of zero checks at multiple places.

Proof of Concept

LaunchEvent.initialize(address,uint256,address,uint256,uint256,uint256,uint256,uint256,uint256,uint256)._issuer (contracts/LaunchEvent.sol#217) lacks a zero-check on :
                - issuer = _issuer (contracts/LaunchEvent.sol#258)
RocketJoeFactory.setRJoe(address)._rJoe (contracts/RocketJoeFactory.sol#159) lacks a zero-check on :
                - rJoe = _rJoe (contracts/RocketJoeFactory.sol#161)
RocketJoeFactory.setPenaltyCollector(address)._penaltyCollector (contracts/RocketJoeFactory.sol#167) lacks a zero-check on :
                - penaltyCollector = _penaltyCollector (contracts/RocketJoeFactory.sol#172)
RocketJoeFactory.setRouter(address)._router (contracts/RocketJoeFactory.sol#178) lacks a zero-check on :
                - router = _router (contracts/RocketJoeFactory.sol#179)
RocketJoeFactory.setFactory(address)._factory (contracts/RocketJoeFactory.sol#185) lacks a zero-check on :
                - factory = _factory (contracts/RocketJoeFactory.sol#186)

Recommended Mitigation Steps

Add zero checks at respective places. Severity depends on viewpoint kind of rationale. Strict zero checks can be seen in almost all sherlock contracts.

cryptofish7 commented 2 years ago

Duplicate of #263