Category: Coding Mistakes
Missing zero-address check
Informational Severity
Informational Impact
N/A Likelihood
Description
The timelock address is allowed to upgrade the contracts, and its address is set during contract initialization. However, the address value is not checked to be nonzero. This address cannot be changed later.
This remark applies also for other addresses like owner, _defaultToken, or _signer. However, some of them may be changed later by the timelock address.
Impact
If by accident the timelock is initialized to zero, the contracts will not be upgradable and the owner cannot be changed.
Recommendations
We recommend to implement zero-address checks in the initialize functions.