F-2024-0006·missing-validation

Lack of Zero address checks

Acknowledgedvaulthealthfipoints
TL;DR

The Points contract lacks zero-address validation across constructor, setVaultAdmin, setApproveToBurn, mint, transferToVault, and createVault, risking token loss and privilege misconfiguration.

Severity
LOW
Impact
MEDIUM
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The contract Points lacks zero address checks for several key parameters and function inputs. Specifically, functions like constructor, setVaultAdmin, setApproveToBurn, mint, transferToVault, and createVault do not validate that the provided addresses are non-zero. Allowing zero addresses can lead to unintended behavior or potential vulnerabilities in the contract's operation.

03Section · Impact

Impact

The absence of zero address checks can lead to multiple issues, including:

  1. Loss of Tokens: Functions like mint and transferToVault could potentially mint or transfer tokens to the zero address, resulting in the permanent loss of those tokens.
  2. Privilege Escalation: Setting administrative roles or approval addresses to the zero address might disrupt the intended access control, allowing unauthorized entities to perform restricted actions.
  3. Operational Disruptions: Using zero addresses in critical mappings (like approveToBurn) can lead to logical errors and unexpected behavior in contract operations.
04Section · Recommendation

Recommendation

To mitigate the risk associated with zero address inputs, it is essential to implement checks that ensure all provided addresses are non-zero. This can be achieved by adding a simple require statement in the relevant functions. Below are the modifications required:

solidity
require(address_parameter != address(0), "Invalid address");
F-2024-0006

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx