[M-03] Insufficient validation while initializing

Summary

In the following function:

  https://github.com/sherlock-audit/2023-01-optimism/blob/main/optimism/packages/contracts-bedrock/contracts/L1/SystemConfig.sol#L110-L125

   function initialize(
  address \_owner,
  uint256 \_overhead,
 uint256 \_scalar,
 bytes32 \_batcherHash,
  uint64 \_gasLimit,
  address \_unsafeBlockSigner
  ) public initializer {
   require(\_gasLimit >= MINIMUM_GAS_LIMIT, "SystemConfig: gas limit 
 too low");
 \_\_Ownable_init();
 transferOwnership(\_owner);
 overhead = \_overhead;
  scalar = \_scalar;
 batcherHash = \_batcherHash;
  gasLimit = \_gasLimit;
  \_setUnsafeBlockSigner(\_unsafeBlockSigner);
    }

there is no validation for the _owner and _unsafeBlockSigner addresses.

Vulnerability Detail

It does not check if owner is not 0 and _unsafeBlockSigner is not 0, meaning that if there is an error ownership will be transferes to address(0), losign ownership of the contract.

Impact

Losign ownership of the contract due to no input validation. The medium severity is granted due to code4rena similar reports that are medium severity. Example: https://solodit.xyz/issues/3537

Code Snippet

  https://github.com/sherlock-audit/2023-01-optimism/blob/main/optimism/packages/contracts-bedrock/contracts/L1/SystemConfig.sol?plain=1#L110-L125

Tool used

Manual Review

Recommendation

Add require statements such as:

 require(_owner != address(0), "SystemConfig: owner is the zero address");
 require(_unsafeBlockSigner != address(0), "SystemConfig: _unsafeBlockSigner is the zero address");

sherlock-audit / 2023-01-optimism-judging

0xWeiss - [M-03] Insufficient validation while initializing #291