Lack of address(0) in the KatanaGovernance::_setFactory function

[c4-bot-10]

Lines of code

https://github.com/ronin-chain/katana-operation-contracts/blob/27f9d28e00958bf3494fa405a8a5acdcd5ecdc5d/src/governance/KatanaGovernance.sol#L340

Vulnerability details

Proof of Concept

The KatanaGovernance::_setFactory function is used to change the value of _v2Factory but depending on the current implementation, this variable can take on an address(0) which is an invalid address.
If _v2Factory is address(0) or is not defined correctly, calling the KatanaGovernance::createPair function will always fail and we will get other unexpected behaviour.

    function _setFactory(address factory) private {
        // @audit lack of address(0) check
        _v2Factory = IKatanaV2Factory(factory);

        emit FactoryUpdated(_msgSender(), factory);
    }

Impact

DOS and unattended behaviour, as some functions will always fail due to an invalid address.

Recommended Mitigation Steps

    function _setFactory(address factory) private {
+       require(factory != address(0), "Invalid address!");
        _v2Factory = IKatanaV2Factory(factory);

        emit FactoryUpdated(_msgSender(), factory);
    }

Assessed type

Invalid Validation

[nevillehuang]

Note, this are not present in the automated finding report for known issues. Grouping all address(0) input validation checks together. They should all likely be at most QA and argubly invalid based on the following READ.ME information:

Centralization risk. Sky Mavis is responsible for maintaining the Katana V3 contracts and will able to upgrade the contract if necessary, as well as specify additional fee tiers.

#101 would require a user error.

• Missing address(0) while initializing the PeripheryImmutableState in his constructor. #111
• Lack of address(0) in the KatanaGovernance::_setFactory function #107
• Missing address(0) check in the Payments::pay function. #101
• Insufficient input validation may lead to loss of funds due to invalid or malicious input data. #183