search

hats-finance / Smooth-0x64bc275b37e62eec81a00ecaecd2b9567058f990

Dappnode's MEV Smoothing Pool
0 stars 2 forks source link

Missing checks for address(0x0) in initialize parameters #22

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: -- Submission hash (on-chain): 0xdab76ab679e709b0be65cb2c86b71025045e3e8882016c2d3df1f3aae4d3395e Severity: low

Description: Description

The initialize parameters lack 0x0 address checks, this can be problematic and might require contract redployment.

Attack Scenario

There are many ways this can affect the contract, e.g governance address can be set to 0, which makes every function protected by onlyGovernace can be called by anyone. Pool fee reciepient can be set to 0 and pool fees can be lost. etc

Attachments

  1. Proof of Concept (PoC) File

Zero addresses can be set here.

        governance = _governance;
        poolFeeRecipient = _poolFeeRecipient;
  1. Revised Code File (Optional)
invocamanman commented 1 year ago

We will check the initialize parameters in the deployment script.