crytic / crytic/slither

Lack of checks by `missing-zero-check` detector in parent contract's constructor.

Open
#981 0 comments 0 reactions 1 assignee Claimed by @dev1644 View on GitHub
bug
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

`missing-zero-check` detector doesn't seem to check the arguments for constructor of parent contracts. Even if the parent contract's constructor has zero-access checks & the child contract is using the same variable, it's gets flagged.

e.g. For this test contract,

```
pragma solidity 0.7.6;

abstract contract Ownable {
address public owner1;
address public owner2;

constructor (address __owner1, address __owner2) {
require(__owner1 != address(0), "Zero");
owner1 = __owner1;
owner2 = __owner2;
}
}

contract ABC is Ownable {

address public owner3;

constructor(address _owner1, address _owner2) Ownable(_owner1, _owner2) {
owner3 = _owner1;
}
}
```
Slither output:
```
ABC.constructor(address,address)._owner1 (contracts/ABC.sol#21) lacks a zero-check on :
- owner3 = _owner1 (contracts/ABC.sol#22)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-address-validation
. analyzed (2 contracts with 103 detectors), 1 result(s) found
```
- Even though `_owner1` is checked for zero address, it gets flagged by the detector.
- `_owner2` doesn't have the check but is ignored by the detector.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.