From d4fb9f96df43c749ab4b4bca9ec987c6dc472928 Mon Sep 17 00:00:00 2001 From: 0xrlawrence Date: Mon, 31 Aug 2026 17:15:21 +0800 Subject: [PATCH] fix: reject the zero address in initializers and setters AlignedLayerServiceManager and BatcherPaymentService both validate every address they are initialized with, but AlignedProofAggregationService validates none of them. A zero newOwner there permanently disables _authorizeUpgrade and every setter, with no way back. Apply the same InvalidAddress check the sibling contracts already use: - AlignedProofAggregationService.initialize: newOwner, alignedAggregatorAddress, sp1VerifierAddress, risc0VerifierAddress - setSP1VerifierAddress and setRisc0VerifierAddress, which would otherwise point verification at an empty address - BatcherPaymentService.withdrawFromServiceManager: withdrawAddress, where transfer() to address(0) succeeds and burns the funds Co-Authored-By: Claude Opus 5 --- .../core/AlignedProofAggregationService.sol | 18 ++++++++++++++++++ contracts/src/core/BatcherPaymentService.sol | 3 +++ .../core/IAlignedProofAggregationService.sol | 2 ++ 3 files changed, 23 insertions(+) diff --git a/contracts/src/core/AlignedProofAggregationService.sol b/contracts/src/core/AlignedProofAggregationService.sol index 3b03efcb76..e424a304e0 100644 --- a/contracts/src/core/AlignedProofAggregationService.sol +++ b/contracts/src/core/AlignedProofAggregationService.sol @@ -54,6 +54,18 @@ contract AlignedProofAggregationService is bytes32 _risc0AggregatorProgramImageId, bytes32 _sp1AggregatorProgramVKHash ) public initializer { + if (newOwner == address(0)) { + revert InvalidAddress("newOwner"); + } + if (_alignedAggregatorAddress == address(0)) { + revert InvalidAddress("alignedAggregatorAddress"); + } + if (_sp1VerifierAddress == address(0)) { + revert InvalidAddress("sp1VerifierAddress"); + } + if (_risc0VerifierAddress == address(0)) { + revert InvalidAddress("risc0VerifierAddress"); + } __Ownable_init(); __UUPSUpgradeable_init(); _transferOwnership(newOwner); @@ -152,6 +164,9 @@ contract AlignedProofAggregationService is /// @notice Sets the address of the Risc0 verifier contract /// @param _risc0VerifierAddress The new address for the Risc0 verifier contract function setRisc0VerifierAddress(address _risc0VerifierAddress) external onlyOwner { + if (_risc0VerifierAddress == address(0)) { + revert InvalidAddress("risc0VerifierAddress"); + } risc0VerifierAddress = _risc0VerifierAddress; emit Risc0VerifierAddressUpdated(_risc0VerifierAddress); } @@ -159,6 +174,9 @@ contract AlignedProofAggregationService is /// @notice Sets the address of the SP1 verifier contract /// @param _sp1VerifierAddress The new address for the SP1 verifier contract function setSP1VerifierAddress(address _sp1VerifierAddress) external onlyOwner { + if (_sp1VerifierAddress == address(0)) { + revert InvalidAddress("sp1VerifierAddress"); + } sp1VerifierAddress = _sp1VerifierAddress; emit SP1VerifierAddressUpdated(_sp1VerifierAddress); } diff --git a/contracts/src/core/BatcherPaymentService.sol b/contracts/src/core/BatcherPaymentService.sol index 379dd03796..b76af0271c 100644 --- a/contracts/src/core/BatcherPaymentService.sol +++ b/contracts/src/core/BatcherPaymentService.sol @@ -194,6 +194,9 @@ contract BatcherPaymentService is uint256 amount, address withdrawAddress ) public payable onlyOwner { + if (withdrawAddress == address(0)) { + revert InvalidAddress("withdrawAddress"); + } alignedLayerServiceManager.withdraw(amount); // reverts if InsufficientBalance // money is now in this contract // we transfer it to the withdraw address diff --git a/contracts/src/core/IAlignedProofAggregationService.sol b/contracts/src/core/IAlignedProofAggregationService.sol index 56b8ddc1a3..c14535f1ad 100644 --- a/contracts/src/core/IAlignedProofAggregationService.sol +++ b/contracts/src/core/IAlignedProofAggregationService.sol @@ -61,4 +61,6 @@ interface IAlignedProofAggregationService { error InvalidProvingSystemId(uint8 actual); error ProvingSystemIdMismatch(uint8 expected, uint8 received); + + error InvalidAddress(string param); }