Lack of Zero address checks
The Points contract lacks zero-address validation across constructor, setVaultAdmin, setApproveToBurn, mint, transferToVault, and createVault, risking token loss and privilege misconfiguration.
Description
The contract Points lacks zero address checks for several key parameters and function inputs. Specifically, functions like constructor, setVaultAdmin, setApproveToBurn, mint, transferToVault, and createVault do not validate that the provided addresses are non-zero. Allowing zero addresses can lead to unintended behavior or potential vulnerabilities in the contract's operation.
Impact
The absence of zero address checks can lead to multiple issues, including:
- Loss of Tokens: Functions like
mintandtransferToVaultcould potentially mint or transfer tokens to the zero address, resulting in the permanent loss of those tokens. - Privilege Escalation: Setting administrative roles or approval addresses to the zero address might disrupt the intended access control, allowing unauthorized entities to perform restricted actions.
- Operational Disruptions: Using zero addresses in critical mappings (like
approveToBurn) can lead to logical errors and unexpected behavior in contract operations.
Recommendation
To mitigate the risk associated with zero address inputs, it is essential to implement checks that ensure all provided addresses are non-zero. This can be achieved by adding a simple require statement in the relevant functions. Below are the modifications required:
require(address_parameter != address(0), "Invalid address");

