Missing validation of address argument could indefinitely lock RebalanceManager contracts

[code423n4]

Handle

defsec

Vulnerability details

Impact

the rebalanceManager parameter are used for the onlyRebalanceManager modifier. In the state variable , proper check up should be done , other wise error in these state variable can lead to redeployment of contract. If the zero address is assigned to rebalanceManager parameter, that will fail all onlyRebalanceManager functions.

Proof of Concept

1. Navigate to the following contract functions.

"https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/callManagers/RebalanceManager.sol#L57"

"https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/callManagers/RebalanceManagerV2.sol#L47"

"https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/callManagers/RebalanceManagerV3.sol#L52"

2. Adding zero address into the rebalanceManager leads to failure of onlyRebalanceManager only functions.

Tools Used

Code Review

Recommended Mitigation Steps

Add proper zero address validation.

[0xleastwood]

No direct security implications, so marking as non-critical.