Why do Solidity audits include checks that function address arguments are not equal to 0x0?

Question

I've recently completed an audit for some Solidity contracts, and one of the checks the auditor included for all of the contracts was to make sure that address function arguments are not equal to the zero address (0x0). Why do audits include this check, what are they trying to protect against?

I also see it in this (dated) checklist for Solidity audits: https://github.com/miguelmota/solidity-audit-checklist

Answer 1

This check is considered important because the following combination applies:

1. Address 0 is neither an externally-owned account nor a smart-contract account
2. Address 0 is a value which can be "easily" passed to a function by mistake

Each factor by itself is not a good-enough reason for this check, because there are many other addresses for which there is (currently) no account ascribed with, but it is not likely for a user to mistakenly pass any of them.

Some web3 implementations may even pass by default a 0 value for every parameter not specified by the user, in which case, even forgetting a parameter can lead to an address 0 being undesirably passed to a function.

Answer 2

I believe, based on the info shared in this OZ forum discussion, that these checks are no longer needed because they are redundant.

https://forum.openzeppelin.com/t/removing-address-0x0-checks-from-openzeppelin-contracts/2222

tldr: prior to some old version solidity the length of the calldata was not checked, so it was possible in dynamic languages like JS to forget to pass in arguments, and those arguments would be set to 0. Now that the calldata length is checked (which costs gas btw) we do not need these checks.