Merge pull request #25 from KaelSensei/fix/slither-missing-zero-checks

fix: Slither missing-zero-check guards

Author: KaelSensei

PROGRESS.md

@@ -11,6 +11,7 @@ A hands-on Solidity training ground based on solidity-by-example.org.
 - [x] **Codecov**: Upgraded `codecov/codecov-action` to v5, added root `codecov.yml` (informational checks, PR comment layout), documented installing the [Codecov GitHub App](https://github.com/marketplace/codecov) in `CI.md` for reliable uploads and PR comments.
 - [x] **Code Scanning / Slither workflow**: Fixed SARIF upload (use `steps.slither-clean.outputs.sarif`, `upload-sarif@v4`, `fetch-depth: 0`, remove `continue-on-error` on clean scan so failed runs do not upload empty SARIF; `crytic/slither-action@v0.4.1`). Corrected `CI.md` (hacks job = artifact only; accurate fail-on / troubleshooting).
 - [x] **Slither medium = 0 (non-hacks, 2026-04)**: Merged CEI-style refactors for AMMs (`ConstantProductAMM`, `ConstantSumAMM`, `StableSwapAMM` with OpenZeppelin `Math.mulDiv`), `Vault.deposit`, staking (`StakingRewards`, `DiscreteStakingRewards`); `Call` / `SendingEther` forward ETH on `receive`; `TargetContract` / `EtherReceiver` gained owner `withdrawEther` so Slither `locked-ether` clears on demos. With `--filter-paths` excluding `src/hacks/`, `lib/`, `test/`, `script/`, Slither reports **zero medium** (low / informational / optimization still exist).
+- [x] **Slither missing-zero-check (2026-04)**: Added zero-address validation on constructors and external entry points flagged by Slither (`UniswapV4*` pool manager + flash-loan token, `PaymentChannel` receiver, `DiscreteStakingRewards` tokens, `Fallback.Proxy` implementation, `CrowdFund` creator, `MinimalProxy` implementation, `TimeLock.execute` target), with matching `vm.expectRevert` tests.
 
 ### ✅ Phase 1: Project Setup
 - [x] Copy training documentation to repo

src/applications/MinimalProxy.sol

@@ -18,6 +18,7 @@ contract MinimalProxy {
 
     /// @notice Constructor sets the implementation address
     constructor(address _implementation) {
+        require(_implementation != address(0), "Zero address");
         implementation = _implementation;
     }
 

src/applications/PaymentChannel.sol

@@ -32,12 +32,14 @@ contract PaymentChannel {
     error ChannelAlreadyClosed();
     error InvalidSignature();
     error TransferFailed();
+    error ZeroAddress();
 
     // ─── Constructor ────────────────────────────────────────────────────
 
     /// @notice Create a payment channel
     /// @dev The sender funds the channel by sending ETH with this constructor call.
     constructor(address _receiver, uint256 _duration) payable {
+        if (_receiver == address(0)) revert ZeroAddress();
         sender = msg.sender;
         receiver = _receiver;
         expiration = block.timestamp + _duration;

src/applications/TimeLock.sol

@@ -31,6 +31,7 @@ contract TimeLock {
     error TimestampNotPassed(uint256 executeTime, uint256 currentTime);
     error TimestampExpired(uint256 executeTime, uint256 expiryTime);
     error ExecutionFailed();
+    error ZeroAddress();
 
     constructor() {
         owner = msg.sender;
@@ -75,6 +76,8 @@ contract TimeLock {
         payable
         onlyOwner
     {
+        if (target == address(0)) revert ZeroAddress();
+
         bytes32 txId = getTxId(target, value, data, executeTime);
 
         if (!queued[txId]) revert NotQueued(txId);

src/basic/Fallback.sol

@@ -50,6 +50,7 @@ contract Proxy {
     address public immutable owner;
 
     constructor(address _implementation) {
+        require(_implementation != address(0), "Zero address");
         implementation = _implementation;
         owner = msg.sender;
     }

src/defi/CrowdFund.sol

@@ -57,6 +57,7 @@ contract CrowdFund {
         uint256 _duration
     ) {
         require(_token != address(0), "Invalid token");
+        require(_creator != address(0), "Invalid creator");
         require(_goal > 0, "Invalid goal");
         require(_duration > 0, "Invalid duration");
 

src/defi/DiscreteStakingRewards.sol

@@ -51,8 +51,10 @@ contract DiscreteStakingRewards {
     error NotOwner();
     error NoRewards();
     error TransferFailed();
+    error ZeroAddress();
 
     constructor(address _stakingToken, address _rewardToken) {
+        if (_stakingToken == address(0) || _rewardToken == address(0)) revert ZeroAddress();
         owner = msg.sender;
         stakingToken = _stakingToken;
         rewardToken = _rewardToken;

src/defi/UniswapV4FlashLoan.sol

@@ -34,6 +34,7 @@ contract UniswapV4FlashLoan {
 
     /// @notice Initialize with PoolManager address
     constructor(address _poolManager) {
+        require(_poolManager != address(0), "Zero address");
         poolManager = _poolManager;
     }
 
@@ -48,6 +49,7 @@ contract UniswapV4FlashLoan {
         uint256 amount,
         bytes calldata data
     ) external {
+        require(token != address(0), "Zero address");
         // Calculate the fee
         uint256 fee = (amount * FLASH_LOAN_FEE_BPS) / 10000;
         uint256 amountToRepay = amount + fee;
@@ -105,6 +107,7 @@ contract UniswapV4FlashLoan {
         address callbackTarget,
         bytes calldata callbackData
     ) external {
+        require(token != address(0), "Zero address");
         uint256 fee = (amount * FLASH_LOAN_FEE_BPS) / 10000;
         uint256 amountToRepay = amount + fee;
 

src/defi/UniswapV4LimitOrder.sol

@@ -62,6 +62,7 @@ contract UniswapV4LimitOrder is ReentrancyGuard {
 
     /// @notice Initialize with PoolManager address
     constructor(address _poolManager) {
+        require(_poolManager != address(0), "Zero address");
         poolManager = _poolManager;
     }
 

src/defi/UniswapV4Swap.sol

@@ -39,6 +39,7 @@ contract UniswapV4Swap {
 
     /// @notice Initialize the contract with a PoolManager address
     constructor(address _poolManager) {
+        require(_poolManager != address(0), "Zero address");
         poolManager = _poolManager;
     }