Functions will be frozen if setXXX to `address(0)`

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-vetoken/blob/main/contracts/Booster.sol#L123-L127 https://github.com/code-423n4/2022-05-vetoken/blob/main/contracts/VoterProxy.sol#L62-L65 https://github.com/code-423n4/2022-05-vetoken/blob/main/contracts/VeAssetDepositor.sol#L53-L57

Vulnerability details

Impact

The setter functions don't verify the address should not be equal to address(0). The protocol will be frozen if setXXX to address(0).

Proof of Concept

There are some setOwner or setFeeManager in the protocol. If the owner is set to address(0) accidentally, the contract will be frozen.

Boosters
* setOwner

VeAssetDepositor.sol
* setFeeManager

VoterProxy.sol
* setOwner

Tools Used

None

Recommended Mitigation Steps

Check address parameters != address(0)

[solvetony]

Duplicate of #247 (#74 for booster, this is for voterProxy)

[GalloDaSballo]

I fail to see how the set of contracts would stop working when setting certain roles to address 0. You would still be able to withdraw and claim all rewards until that point.

Because of that I'm downgrading to QA