Immunefi Audit Competitions
Plume | Attackathon

51918 sc insight redundant zero address checks for router address

Submitted on: Aug 6th 2025 at 15:34:29 UTC
Submitted by: @Am3nh3l for Attackathon | Plume Network
Report ID: #51918
Report Type: Smart Contract
Severity: Insight
Target: https://github.com/immunefi-team/attackathon-plume-network/blob/main/arc/src/ArcToken.sol

Description

The ArcToken contract contains redundant zero address checks for the router address in _isYieldAllowed and _update functions. These checks are unnecessary because the initialize function already enforces a non-zero router address and there is no mechanism to reset it to zero later.

This is an insight: the redundant checks add unnecessary gas cost and complexity but do not introduce a security issue by themselves.

Brief / Intro

The initialize function enforces that the router address is not the zero address:

require(routerAddress_ != address(0), "Router address cannot be zero");

Despite that, _isYieldAllowed and _update still check if restrictionsRouter is zero and revert with RouterNotSet() if so.

Vulnerability Details

  • initialize requires a non-zero router address, ensuring restrictionsRouter is set to a valid address during initialization.
  • _isYieldAllowed and _update perform redundant checks like:
if (routerAddr == address(0)) {
    revert RouterNotSet();
}
  • There is no mechanism in the contract to set restrictionsRouter back to the zero address after initialization.
  • Therefore these checks are redundant and can be removed to reduce gas usage and simplify the code.

Impact Details

Insight — redundant checks increase gas usage and add code complexity but do not create an exploitable condition under the described contract design.

References

Proof of Concept

Automated check placeholder

PlaceHolder for automated check.