Lack of checks by `missing-zero-check` detector in parent contract's constructor.
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
`missing-zero-check` detector doesn't seem to check the arguments for constructor of parent contracts. Even if the parent contract's constructor has zero-access checks & the child contract is using the same variable, it's gets flagged.
e.g. For this test contract,
```
pragma solidity 0.7.6;
abstract contract Ownable {
address public owner1;
address public owner2;
constructor (address __owner1, address __owner2) {
require(__owner1 != address(0), "Zero");
owner1 = __owner1;
owner2 = __owner2;
}
}
contract ABC is Ownable {
address public owner3;
constructor(address _owner1, address _owner2) Ownable(_owner1, _owner2) {
owner3 = _owner1;
}
}
```
Slither output:
```
ABC.constructor(address,address)._owner1 (contracts/ABC.sol#21) lacks a zero-check on :
- owner3 = _owner1 (contracts/ABC.sol#22)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-address-validation
. analyzed (2 contracts with 103 detectors), 1 result(s) found
```
- Even though `_owner1` is checked for zero address, it gets flagged by the detector.
- `_owner2` doesn't have the check but is ignored by the detector.
Contributor guide
Assessment
This issue has not been assessed yet.