setupParticipant() function does not check for zero address

[code423n4]

Handle

jayjonah8

Vulnerability details

Impact

The setupParticipant() function in AuctionParticipant.sol does not have require statements to protect again contracts that do not yet exist. It sets the addresses for " _impliedCollateralService", "_rewardToken", and "_auction" and can only be called once so its vital to have this guard in place.

Proof of Concept

https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/AuctionParticipant.sol#L26

Tools Used

Manual code review

Recommended Mitigation Steps

Add require checks for the addresses that are passed in the setupParticipant() function checking if they exist like: require("address" != address(0), "contract does not exist")

[GalloDaSballo]

The check against address 0 is a good idea for vital parts of the code.
However the warden didn't show any specific attack or vulnerability that would be exposed by setting any of those variables to address(0)
I agree with adding the check, mostly because it's a best-practice, however am going to downgrade the finding to low severity, which is in line with the severity given by most auditing firms for this type of finding.