Missing zero-address checks

[code423n4]

Handle

0xRajeev

Vulnerability details

Impact

Checking addresses against zero-address during initialization or during setting is a security best-practice. However, such checks are missing in all address variable initializations.

Impact: Allowing zero-addresses will lead to contract reverts and force redeployments if there are no setters for such address variables.

Proof of Concept

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/IdleYieldSource.sol#L62

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/SushiYieldSource.sol#L23-L24

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/YearnV2YieldSource.sol#L81-L82

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/BadgerYieldSource.sol#L20-L21

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/ATokenYieldSource.sol#L96

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/ATokenYieldSource.sol#L100

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/PrizePool.sol#L235

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/ControlledToken.sol#L34

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/YieldSourcePrizePool.sol#L41

https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/StakePrizePool.sol#L36

Tools Used

Manual Analysis

Recommended Mitigation Steps

Add zero-address checks for all initializations of address state variables.

[kamescg]

Core

• https://github.com/pooltogether/pooltogether-pool-contracts/pull/new/fix/65
• add zero-address checks to Ticket and ControlledToken pooltogether/pooltogether-pool-contracts#306

Aave

• https://github.com/pooltogether/aave-yield-source/pull/new/fix/65
• add zero-address checks pooltogether/aave-yield-source#22

Sushi

• https://github.com/pooltogether/sushi-pooltogether/pull/new/fix/65
• https://github.com/steffenix/sushi-pooltogether/pull/21

Idle

• https://github.com/pooltogether/idle-yield-source/pull/new/fix/65
• add zero-address checks pooltogether/idle-yield-source#3

Badger

• https://github.com/pooltogether/badger-yield-source/pull/new/fix/65
• Fix/65 add zero-address checks pooltogether/badger-yield-source#6