Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

No Address zero check #352

Open
code423n4 opened this issue Sep 19, 2022 · 4 comments
Open

No Address zero check #352

code423n4 opened this issue Sep 19, 2022 · 4 comments
Labels
bug Something isn't working QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax sponsor acknowledged Technically the issue is correct, but we're not going to resolve it for XYZ reasons

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/distribution/TokenDistributor.sol#L94

Vulnerability details

Impact

The Global Variable is an immutable state variable that cannot be changed after deployment, wrongly setting the address can have a great effect on the performance of the protocol.

Proof of Concept

https://github.com/PartyDAO/party-contracts-c4/blob/3896577b8f0fa16cba129dc2867aba786b730c1b/contracts/distribution/TokenDistributor.sol#L94

Tools Used

Recommended Mitigation Steps

A proper check should be done on the address pass in the constructor to make sure address zero is not passed at the point of deployment, this will help to avoid spending extra deployment cost if address 0 is passed as the Admin might want to correct the error by deploying another contract:
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Sep 19, 2022
code423n4 added a commit that referenced this issue Sep 19, 2022
@code423n4
The_GUILD issue #352
ba26fb9
@merklejerk merklejerk added the sponsor acknowledged Technically the issue is correct, but we're not going to resolve it for XYZ reasons label Sep 22, 2022
@merklejerk
Copy link
Collaborator

Not worth it imo. We could also easily accidentally set it to a non-zero address we don't control.

@trust1995
Copy link

I also don't think this is valid

@HardlyDifficult
Copy link
Collaborator

Seems valid, but NC since this is a constructor they could just deploy again to correct a mistake.

Converting into a QA report for the warden.

@HardlyDifficult HardlyDifficult added QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value labels Oct 6, 2022
@HardlyDifficult HardlyDifficult mentioned this issue Oct 6, 2022
Closed
@HardlyDifficult
Copy link
Collaborator

Merging with #353

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax sponsor acknowledged Technically the issue is correct, but we're not going to resolve it for XYZ reasons
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@merklejerk @trust1995 @HardlyDifficult @code423n4