fix: RSR-05 | Missing Zero Address Validation

VenusProtocol · Feb 6, 2025 · 512d5bc · 512d5bc
1 parent c8a5a08
commit 512d5bc
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/contracts/RiskSteward/RiskStewardReceiver.sol b/contracts/RiskSteward/RiskStewardReceiver.sol
@@ -144,6 +144,7 @@ contract RiskStewardReceiver is IRiskStewardReceiver, PausableUpgradeable, Acces
      * @custom:access Controlled by AccessControlManager
      * @custom:error Throws UnsupportedUpdateType if the update type is an empty string
      * @custom:error Throws InvalidDebounce if the debounce is 0
+     * @custom:error Throws ZeroAddressNotAllowed if the risk steward address is zero
      */
     function setRiskParameterConfig(string calldata updateType, address riskSteward, uint256 debounce) external {
         _checkAccessAllowed("setRiskParameterConfig(string,address,uint256)");
@@ -153,6 +154,7 @@ contract RiskStewardReceiver is IRiskStewardReceiver, PausableUpgradeable, Acces
         if (debounce == 0 || debounce > UPDATE_EXPIRATION_TIME) {
             revert InvalidDebounce();
         }
+        ensureNonzeroAddress(riskSteward);
         RiskParamConfig memory previousConfig = riskParameterConfigs[updateType];
         riskParameterConfigs[updateType] = RiskParamConfig({
             active: true,

diff --git a/tests/RiskSteward/RiskStewardReceiver.ts b/tests/RiskSteward/RiskStewardReceiver.ts
@@ -237,6 +237,12 @@ describe.only("Risk Steward", async function () {
       ).to.be.rejectedWith("InvalidDebounce");
     });
 
+    it("should not support zero risk steward address", async function () {
+      await expect(
+        riskStewardReceiver.setRiskParameterConfig("supplyCap", ethers.constants.AddressZero, 1),
+      ).to.be.rejectedWith("ZeroAddressNotAllowed");
+    });
+
     it("should revert if debounce is greater than UPDATE_EXPIRATION_TIME", async function () {
       await expect(
         riskStewardReceiver.setRiskParameterConfig("supplyCap", marketCapsRiskSteward.address, 60 * 60 * 24 + 1),