# BRC20Factory::addSigner() and Vault::addSigner() must not allow adding the zero address as a signer Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-L04 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description The signature verification in BRC20Factory and Vault does not check that the recovered address is not null, which means that if address(0) is added as a signer, it would be possible to forge signatures. ### Recommendation In BRC20Factory::addSigner() and Vault::addSigner(), revert if an address(0) account is sent as argument. ### Status Addressed in [#4082cc6](https://github.com/orangecryptohq/orange-bridge-contract/commit/4082cc6c71377435a7c164692a8aa07c8fe0ce66). --- Related findings: - [Add a 0 address check on the pool when adding liquidity for greater verbosity](https://0xsimao.com/findings/nftperp-ii-add-adding-greater-verbosity): Nftperp Matching Engine - [MapleLoan, skim() has no zero address transfer check.](https://0xsimao.com/findings/maple-finance-iii-skim-zero-address-transfer): Maple Finance - [BasicVaultFactory::createVault() inconsistent already existing vault check](https://0xsimao.com/findings/mitosis-create-inconsistent-already-existing): Mitosis - [`PreDepositVault::sweep()` uses `address.transfer` which does not work for certain wallets](https://0xsimao.com/findings/gaib-deposit-sweep-transfer-wallets): GAIB Pre-Vaults