Missing zero address validation

[hats-bug-reporter[bot]]

Github username: -- Twitter username: -- Submission hash (on-chain): 0xace2ef33772849bc0849fc29f916d8485abf48976320f6e3dfd8c7818a4c78f3 Severity: low

Description: Description\ address should be validated for zero value before assigning to a storage variable

Attack Scenario\ setting to zero address will brick the protocol functioning.

Code Details

File: contracts/Most.sol

/// @audit ******************* Issue Detail *******************
Most.initialize(address[],uint256,address,address)._wethAddress (contracts/Most.sol#87) lacks a zero-check on :
    - wethAddress = _wethAddress (contracts/Most.sol#90)

/// @audit ************** Possible Issue Line(s) **************
    L#87,  L#90,  

/// @audit ****************** Affected Code *******************
  87:         address payable _wethAddress
  90:         wethAddress = _wethAddress;

File: contracts/Most.sol

/// @audit ******************* Issue Detail *******************
Most.recoverNative(address,uint256).to (contracts/Most.sol#293) lacks a zero-check on :
    - (success) = to.call{gas: GAS_LIMIT,value: amount}() (contracts/Most.sol#296)

/// @audit ************** Possible Issue Line(s) **************
    L#293,  L#296,  

/// @audit ****************** Affected Code *******************
 293:         address payable to,
 296:         (bool success, ) = to.call{value: amount, gas: GAS_LIMIT}("");

Attachments

1. Proof of Concept (PoC) File
   • call to sendRequestNative will fail of weth is set to 0x00 address

Files:

• PoC - zero address.sol (https://hats-backend-prod.herokuapp.com/v1/files/QmWzJ84FrtLpYqtzceFseTJNSe1QwaMrGtmXRoaebneRP4)

[krzysztofziobro]

duplicate of https://github.com/hats-finance/Most--Aleph-Zero-Bridge-0xab7c1d45ae21e7133574746b2985c58e0ae2e61d/issues/10