I've recently completed an audit for some Solidity contracts, and one of the checks the auditor included for all of the contracts was to make sure that address function arguments are not equal to the zero address (0x0). Why do audits include this check, what are they trying to protect against?

I also see it in this (dated) checklist for Solidity audits: https://github.com/miguelmota/solidity-audit-checklist


This check is considered important because the following combination applies:

  1. Address 0 is neither an externally-owned account nor a smart-contract account
  2. Address 0 is a value which can be "easily" passed to a function by mistake

Each factor by itself is not a good-enough reason for this check, because there are many other addresses for which there is (currently) no account ascribed with, but it is not likely for a user to mistakenly pass any of them.

Some web3 implementations may even pass by default a 0 value for every parameter not specified by the user, in which case, even forgetting a parameter can lead to an address 0 being undesirably passed to a function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.