This repository has been archived by the owner on Jul 28, 2024. It is now read-only.
krkba - Admin can set to zero address. #8
Labels
Non-Reward
This issue will not receive a payout
Comments
github-actions
bot
added
the
Duplicate
sherlock-admin2
changed the title
sherlock-admin2
added
Non-Reward
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
krkba
medium
Admin can set to zero address.
krkba
Summary
There is lack of input validation in
constructor.Vulnerability Detail
When there is no zero address validation in
timelock_address , it can be set to zero and then in the line 37 the admin is set totimelock_which is zero address.Impact
Admin can set to zero address.
Code Snippet
https://github.com/sherlock-audit/2024-01-olympus-on-chain-governance/blob/main/bophades/src/external/governance/GovernorBravoDelegator.sol#L11
https://github.com/sherlock-audit/2024-01-olympus-on-chain-governance/blob/main/bophades/src/external/governance/GovernorBravoDelegator.sol#L37
Tool used
Manual Review
Recommendation
Validate the input of
timelock_.Duplicate of #39
The text was updated successfully, but these errors were encountered: