address(0) check could be added to MetavaultRegistry::registerMetavault()
Summary
It's technically possible to register a zero address metavault.
Vulnerability Detail
function registerMetavault(address metavault, address[] memory markets) external restricted {
MetavaultConfig storage config = _getMvConfigStorage().metavaults[metavault];
if (config.metavault != address(0)) revert MetavaultAlreadyRegistered(metavault);
config.metavault = metavault;
config.chainsCount = 1;
// register the first markets to whitelist during the metavault registration
for (uint256 i = 0; i < markets.length; i++) {
config.markets.push(markets[i]);
MarketConfig memory marketConfig = MarketConfig({isRegistered: true});
config.marketConfigs[markets[i]] = marketConfig;
_registerPoolInfos(markets[i]);
emit MarketRegistered(metavault, markets[i]);
}
// Register current chain
MetavaultChainConfig memory chainConfig = MetavaultChainConfig({
chainId: block.chainid,
remoteMetavaultAddress: metavault
});
config.chains.push(chainConfig);
config.chainConfigs[block.chainid] = chainConfig;
emit ChainRegistered(metavault, block.chainid, metavault);
emit MetavaultRegistered(metavault);
}Impact
It would be an admin mistake.
Code Snippet
Tool Used
Manual Review
Recommendation
Check if the metavault is not the zero address.