Missing Zero Address Validation Remediation

Overview

Related Detector: Missing Zero Address Validation

The zero address (address(0)) is a valid input to any address parameter, but it is almost never a valid destination. Assigning it to an owner or role burns control of the contract; sending tokens or ether to it destroys them. The fix is a cheap guard on every address input that feeds ownership, roles, recipients, or critical configuration.

Recommended Fix

Before (Vulnerable)

contract Vault {
    address public owner;
    function setOwner(address newOwner) external {
        // No check — newOwner can be address(0), permanently bricking access control
        owner = newOwner;
    }
}

After (Fixed)

contract Vault {
    address public owner;

    error ZeroAddress();

    function setOwner(address newOwner) external {
        if (newOwner == address(0)) revert ZeroAddress();
        owner = newOwner;
    }
}

Guard the same way in constructors, token mint/transfer recipients, and any setter that stores an address used for authorization or value routing.

Common Mistakes

Validating the recipient but not the constructor argument that seeds the same role at deploy time.
Checking one path (e.g. transfer) while leaving transferFrom or a batch variant unguarded.
Relying on transferOwnership from a library without confirming that library rejects the zero address in the version you compiled against.