Class ZeroAddress

A detector that identifies uses of the zero address.

Why is it bad?

Using the zero address in smart contracts is typically problematic because it can be exploited as a default or uninitialized address, leading to unintended transfers and security vulnerabilities. Additionally, operations involving the zero address can result in loss of funds or tokens, as there is no private key to access this address.

Example

contract Proxy {
  to: Address;
  init() {
    // Warning: Insecure usage of zero address as default value
    self.to = newAddress(0, 0);
  }
  fun setAddress(to: Address) {
    self.to = to
  }
}

Use instead:

contract Proxy {
  to: Address;
  init(to: Address) {
    // Fixed: Using the input value on initialization.
    self.to = to;
  }
  fun setAddress(to: Address) {
    self.to = to
  }
}

Hierarchy (view full)

Constructors

constructor

Properties

ctx severity

Accessors

id kind shareImportedWarnings usesSouffle

Methods

check makeWarning skipUnused

Constructors

constructor

Properties

Readonlyctx

ctx: MistiContext

severity

severity: Severity = Severity.LOW

Gets the severity of the detector.

Accessors

id

  • get id(): string

  • Gets the short identifier of the detector, used in analyzer warnings.

    Returns string

    The unique identifier of the detector.

kind

shareImportedWarnings

  • get shareImportedWarnings(): WarningsBehavior

  • Defines the behavior of warnings generated by this detector when working with multiple projects within a single Tact configuration.

    Here are the available options:

    1. "union" Leave this value if you don't care about warnings generated in other projects.
    2. "intersect" If the warning is generated for some source location of the imported file, it should be generated by each of the projects. Example: Constants from an imported file should not be reported iff they are unused in all the projects, so you need "intersect".

    Returns WarningsBehavior

usesSouffle

  • get usesSouffle(): boolean

  • Checks whether this detector needs the Soufflé binary to be executed.

    Returns boolean

Methods

check

ProtectedmakeWarning

ProtectedskipUnused

Settings

Member Visibility

On This Page

Why is it bad?Example
Constructors
Properties
Accessors
Methods