Lines of code

Vulnerability details

Impact

The initialize function accepts a parameter _l2CoreGovTimelock and does check if it’s a contract address using Address.isContract(). However, there’s no explicit check to ensure that _l2CoreGovTimelock is not the zero address (0x0000000000000000000000000000000000000000), which is a common source of issues in Ethereum smart contracts.

Proof of Concept

Assigning the zero address to _l2CoreGovTimelock may lead to undesired behaviors, lost funds, or security vulnerabilities, depending on how _l2CoreGovTimelock is used throughout the contract.

Tools Used

Manual

Recommended Mitigation Steps

Add a check at the start of the initialize function to ensure that _l2CoreGovTimelock is not the zero address:

require(_l2CoreGovTimelock != address(0), "_l2CoreGovTimelock cannot be the zero address");

Assessed type

Invalid Validation

The text was updated successfully, but these errors were encountered:

All reactions