Missing zero-address checks on LockeERC20 and Stream construction

[code423n4]

Handle

hyh

Vulnerability details

Impact

Being instantiated with wrong configuration, the contract is inoperable and deploy gas costs will be lost.
If misconfiguration is noticed too late the various types of malfunctions become possible.

Proof of Concept

The checks for zero addresses during contract construction and initialization are best-practices.

Now LockeERC20 and Stream contracts do not check for correctness of constructor arguments:

LockeERC20
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/LockeERC20.sol#L56

Stream
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L263

Recommended Mitigation Steps

Add zero-address checks and key non-address variables checks in all contract constructors. Small increase of gas costs are far out weighted by wrong deploy costs savings and additional coverage against misconfiguration.