Lack of input validation
Parameters are used without checking that they are within sane bounds.
What it is
Addresses stored without a zero check, amounts accepted without an upper bound, array indices used without a length check, arrays of mismatched length iterated in parallel, percentages set above 100.
Why it matters
Ownership transferred to the zero address is unrecoverable. Fees set to absurd values block every trade. Mismatched array lengths silently skip or duplicate operations in a batch.
How to fix it
- Require non-zero addresses wherever an address is stored.
- Bound every numeric setter, and enforce the bound in the setter rather than in documentation.
- Check that parallel arrays have equal length before iterating them.
How it is detected
Every audit on EVM Smart Audit checks for SC04 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.
Check your contract for lack of input validation
The engine runs this check and 21 others on every audit, and shows what passed as well as what failed.
Start audit