Lack of validation for Ethereum addresses [code-improvement]

[0xM3R]

File: universalSetConnected.ts
Issue: Lack of validation for Ethereum addresses in args.zrc20 and args.connected.

Analysis

The vulnerable implementation is as follows:

const tx = await contract.setConnected(args.zrc20, args.connected);

• Unvalidated Input: The addresses are used without verification.

How It Can Be Harmful

• Invalid Inputs: Using unvalidated addresses can lead to transaction failures or unintended contract behavior.

How to Mitigate the Issue

1. Validate Ethereum Addresses: Ensure the addresses are valid before use.

import { isAddress } from "ethers/lib/utils";

if (!isAddress(args.zrc20) || !isAddress(args.connected)) {
    throw new Error("Invalid Ethereum address provided.");
}

References

• Improper Input Validation in Smart Contracts
  Discusses the risks of inadequate input validation in smart contracts.
  Metana Blog
• CVE-2024-32649
  Highlights vulnerabilities due to improper input validation in smart contracts.
  CVE Details