<!-- canonical: https://0xsimao.com/findings/spectra-metavault-added-metavault-registry-register -->

# address(0) check could be added to `MetavaultRegistry::registerMetavault()`

Low/Info · Sherlock · Yield-tokenisation vaults · 16th December 2025

Finding I-2 of the Spectra MetaVault Bridge security review.

- Protocol: https://www.spectra.finance/
- Report: /reports/spectra-metavault-bridge
- Source: https://github.com/0xsimao/audits/blob/main/Sherlock/private-audits/2025-12-16-spectra-metavault.pdf

---

## Summary

It's technically possible to register a zero address metavault.

## Vulnerability Detail

```solidity
function registerMetavault(address metavault, address[] memory markets) external restricted {
    MetavaultConfig storage config = _getMvConfigStorage().metavaults[metavault];
    if (config.metavault != address(0)) revert MetavaultAlreadyRegistered(metavault);

    config.metavault = metavault;
    config.chainsCount = 1;

    // register the first markets to whitelist during the metavault registration
    for (uint256 i = 0; i < markets.length; i++) {
        config.markets.push(markets[i]);
        MarketConfig memory marketConfig = MarketConfig({isRegistered: true});
        config.marketConfigs[markets[i]] = marketConfig;
        _registerPoolInfos(markets[i]);
        emit MarketRegistered(metavault, markets[i]);
    }

    // Register current chain
    MetavaultChainConfig memory chainConfig = MetavaultChainConfig({
        chainId: block.chainid,
        remoteMetavaultAddress: metavault
    });
    config.chains.push(chainConfig);
    config.chainConfigs[block.chainid] = chainConfig;
    emit ChainRegistered(metavault, block.chainid, metavault);
    emit MetavaultRegistered(metavault);
}
```

## Impact

It would be an admin mistake.

## Code Snippet

https://github.com/sherlock-audit/2025-12-spectra-metavault-update-dec-16th/pull/2/files#diff-d6dbd850708b46c46f64d8bc2d13e4fe2de6f7ac75f0981bf638274c7830a293R83

## Tool Used

Manual Review

## Recommendation

Check if the metavault is not the zero address.

Disclosed by 0xSimao (https://0xsimao.com/).

---

Related findings:

- [KeyringCoreV2Base::registerKey() could check that validTo is equal to or bigger than block.timestamp](https://0xsimao.com/findings/keyring-ii-register-equal-bigger-timestamp): Keyring Credentials
- [address(0) can be added as a pair, triggering taxes on burn](https://0xsimao.com/findings/trestle-address-triggering-taxes-burn): Trestle wTIA Bridge
- [OstiumLinkUpKeep:topUp() is missing a length check for registryAddresses](https://0xsimao.com/findings/ostium-link-top-registry-addresses): Ostium
- [_to argument missing 0x0 address check in the ConnextRouter](https://0xsimao.com/findings/fuji-finance-argument-0x0-address-connext): Fuji Finance