Improper validation of return value when creating a new tranch token

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/util/Factory.sol#L96

Vulnerability details

Impact

The Factory contract uses the newTrancheToken() function to deploy a tranche token using create2 instruction. However, the Factory does not validate the address returned by create2, which will be the zero address if the deployment operation fails. This lack of validation may lead to problems

Proof of Concept

Tools Used

vscode

Recommended Mitigation Steps

TrancheToken token = new TrancheToken{salt: salt}(decimals);
if(token == address(0)) revert TokenDeploymentFailed(token);

Assessed type

Invalid Validation

[raymondfam]

Sanity check. QA at best.

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[c4-judge]

gzeon-c4 marked the issue as unsatisfactory:
Invalid