millietez - No validation of the address parameter value in the contract constructor

[sherlock-admin]

millietez

medium

No validation of the address parameter value in the contract constructor

Summary

No validation of the address parameter value in the contract constructor

Vulnerability Detail

In the DepositStableCoinToDeale contract, the variable is assigned the value of the constructor input parameter. But this parameter is not checked beforehand, and also the implementation of the interface is not checked. If the value turns out to be zero, then it will be necessary to redeploy the contract, since there is no other functionality to set this variable.

In line 23 https://github.com/JOJOexchange/smart-contract-EVM/blob/aca8529979caa9e99ea48948645e041925731ef4/src/DepositStableCoinToDealer.sol#L23 the jojoDealer variable is set to the value of the _JOJODealer input parameter, the usdc variable is set to the value of the _usdc input parameter, the weth variable is set to the value of the _weth input parameter.

Impact

If the dealer is used to conduct operations or exchanges, setting the dealer's address to zero will make it impossible to interact with it.

Code Snippet

https://github.com/JOJOexchange/smart-contract-EVM/blob/aca8529979caa9e99ea48948645e041925731ef4/src/DepositStableCoinToDealer.sol#L23

Tool used

Manual Review

Recommendation

It is necessary to add a check of the input parameter to zero before initializing the variable and utilize ERC165 checks to verify the interface.

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid because { constructor == admin task -> invalid}

[nevillehuang]

Invalid, known issue and address zero check is not valid based on sherlock rules

3. Zero address checks: Check to make sure input values are not zero addresses.