Description

The registerMarket function does not validate payoutToken_ and quoteToken_ addresses for a zero address value.

Impact

Such a market will be impossible to use, so it is worth avoiding creating markets with zero token addresses.

Recommendations

We recommend implementing zero-address checks, such as the ones shown below:

function registerMarket(ERC20 payoutToken_, ERC20 quoteToken_)
    external
    override
    returns (uint256 marketId)
{
    if (!_whitelist[msg.sender]) revert Aggregator_OnlyAuctioneer();
    require(payoutToken_ != address(0) && quoteToken_ != address(0), "zero address");
    ...
}

Remediation

Bond Labs acknowledged this finding and implemented a fix in commit e9042fc7↗.