Missing zero address check which will put forfeited rewards at risk(ForefeitHandler.sol)

[code423n4]

Handle

0xwags

Vulnerability details

Impact

Since users forfeited awards will be shared between either the treasury and the swing trader, there should be a zero address in the initialize() function to ensure rewards are not lost and thereby affecting Malt's collateralisation and other such funding mechanism.

This will have implications for safetransfer() functions in lines 50 & 54 in handleForfeit().

Tools Used

Manual Analysis.

Recommended Mitigation Steps

require(treasuryMultisig&& swingTrader ! =address(0), "0x0");

[GalloDaSballo]

Heavily disagree with severity on this finding

The finding is valid, but as per most auditing firms, lack of input validation is a low severity finding.

The consequences showed by the warden are not as dire as they sound as calling as doing a CALL on the address 0 will revert

Will mark this as Low Seveirty