Skip to content
Request an audit

‹ All findings

BRC20Factory::addSigner() and Vault::addSigner() must not allow adding the zero address as a signer

Low/InfoOrange Bridge·Three Sigma · Cross-chain bridge · 15th July, 20243S-OB-L04

ReportSource

Description

The signature verification in BRC20Factory and Vault does not check that the recovered address is not null, which means that if address(0) is added as a signer, it would be possible to forge signatures.

Recommendation

In BRC20Factory::addSigner() and Vault::addSigner(), revert if an address(0) account is sent as argument.

Status

Addressed in #4082cc6.