Input Validation

Input Validation Vulnerability Analysis

OWASP SC04:2025 - Lack of Input Validation allows attackers to pass unexpected values that break contract invariants or enable exploits.

2025-2026 Statistics: Input validation failures account for 34.6% of all smart contract vulnerabilities, contributing to $420M+ in losses.

Why Input Validation Fails (Root Causes)

Root Cause 1: Assumption of Good Faith

Developers assume callers will provide sensible inputs.

// VULNERABLE: Assumes recipient is valid
function transfer(address to, uint256 amount) external {
    balances[msg.sender] -= amount;
    balances[to] += amount;  // @audit to = address(0) burns tokens
}

Attacker's view: "They didn't check my input. Let me see what happens with edge cases."

Root Cause 2: Missing Bounds Checking

Parameters have implicit bounds that aren't enforced.

// VULNERABLE: No bounds on fee
function setFee(uint256 newFee) external onlyOwner {
    fee = newFee;  // @audit newFee = 100% drains users
}

Root Cause 3: Type Confusion

Solidity's loose typing allows unexpected conversions.

// VULNERABLE: Assumes bytes4 is valid selector
function executeCall(address target, bytes4 selector, bytes calldata data) external {
    (bool success,) = target.call(abi.encodePacked(selector, data));
    // @audit selector could be anything, including dangerous functions
}

Root Cause 4: Array/Calldata Trust

Trusting array lengths and calldata structure from external sources.

// VULNERABLE: Trusts array lengths match
function batchTransfer(address[] calldata recipients, uint256[] calldata amounts) external {
    for (uint256 i = 0; i < recipients.length; i++) {
        _transfer(recipients[i], amounts[i]);  // @audit Arrays may have different lengths
    }
}

The Input Validation Matrix (Core Artifact)

For each external function, document:

Detection Patterns

Pattern 1: Missing Zero Address Check

Root Cause: Assumption of Good Faith

// VULNERABLE: Zero address burns tokens/ETH
function withdraw(address recipient) external {
    uint256 amount = balances[msg.sender];
    balances[msg.sender] = 0;
    payable(recipient).transfer(amount);  // @audit recipient = 0x0 burns ETH
}

// VULNERABLE: Zero address as critical role
function setAdmin(address newAdmin) external onlyOwner {
    admin = newAdmin;  // @audit newAdmin = 0x0 bricks admin functions
}

Attack Flow:

1. Attacker (or accident) calls with address(0)
2. Tokens/ETH sent to zero address are burned
3. Or critical role set to zero, bricking functionality
4. Irreversible loss

Search Queries:

Grep("address.*=|= address", glob="**/*.sol")
Grep("require.*!= address\\(0\\)", glob="**/*.sol")
Grep("setAdmin|setOwner|set.*Address", glob="**/*.sol")

Mitigation:

function setAdmin(address newAdmin) external onlyOwner {
    require(newAdmin != address(0), "Zero address");
    admin = newAdmin;
}

Pattern 2: Missing Amount/Value Bounds

Root Cause: Missing Bounds Checking

// VULNERABLE: Fee can be set to 100%
function setFee(uint256 newFee) external onlyOwner {
    fee = newFee;  // @audit No maximum check
}

function withdraw(uint256 amount) external {
    uint256 feeAmount = amount * fee / 10000;
    uint256 netAmount = amount - feeAmount;  // @audit Can underflow if fee > 10000
    token.transfer(msg.sender, netAmount);
}

Attack Flow:

1. Malicious/compromised admin sets fee = 10000 (100%)
2. All user withdrawals get 0 tokens
3. Or fee = 20000 causes underflow (reverts all withdrawals)

Search Queries:

Grep("setFee|setRate|setMultiplier|setPercent", glob="**/*.sol")
Grep("external.*uint.*\\{[^}]*=[^}]*\\}", glob="**/*.sol")

Mitigation:

uint256 public constant MAX_FEE = 1000; // 10%

function setFee(uint256 newFee) external onlyOwner {
    require(newFee <= MAX_FEE, "Fee too high");
    fee = newFee;
}

Pattern 3: Array Length Mismatch

Root Cause: Array/Calldata Trust

// VULNERABLE: No length check
function batchTransfer(
    address[] calldata recipients,
    uint256[] calldata amounts
) external {
    for (uint256 i = 0; i < recipients.length; i++) {
        _transfer(recipients[i], amounts[i]);  // @audit Out of bounds if amounts shorter
    }
}

Attack Flow:

1. Attacker calls with recipients.length = 10, amounts.length = 5
2. Loop accesses amounts[5], amounts[6], etc.
3. Reverts or reads garbage data
4. Unexpected behavior

Search Queries:

Grep("\\[\\].*calldata.*,.*\\[\\].*calldata", glob="**/*.sol")
Grep("for.*recipients\\.length|for.*addresses\\.length", glob="**/*.sol")

Mitigation:

function batchTransfer(
    address[] calldata recipients,
    uint256[] calldata amounts
) external {
    require(recipients.length == amounts.length, "Length mismatch");
    require(recipients.length > 0, "Empty array");
    require(recipients.length <= MAX_BATCH_SIZE, "Batch too large");
    // ...
}

Pattern 4: Missing Zero Amount Check

Root Cause: Assumption of Good Faith

// VULNERABLE: Zero amount wastes gas and may break logic
function stake(uint256 amount) external {
    token.transferFrom(msg.sender, address(this), amount);
    stakes[msg.sender] += amount;
    emit Staked(msg.sender, amount);
    // @audit amount = 0 creates empty stake event, may break off-chain tracking
}

// VULNERABLE: Zero amount mints shares
function deposit(uint256 assets) external returns (uint256 shares) {
    shares = convertToShares(assets);
    // @audit If totalAssets = 0, assets = 0 gives shares = 0, wasting gas
    _mint(msg.sender, shares);
}

Search Queries:

Grep("function.*deposit.*uint|function.*stake.*uint", glob="**/*.sol")
Grep("require.*> 0|require.*!= 0", glob="**/*.sol")

Pattern 5: Dangerous Selector/Calldata

Root Cause: Type Confusion

// VULNERABLE: Arbitrary function call
function execute(address target, bytes calldata data) external onlyOwner {
    (bool success,) = target.call(data);  // @audit Can call ANY function
    require(success);
}

// VULNERABLE: Callback with untrusted selector
function processCallback(bytes4 selector, bytes calldata params) external {
    (bool success,) = msg.sender.call(abi.encodePacked(selector, params));
    // @audit Attacker controls selector
}

Search Queries:

Grep("\\.call\\(data\\)|\\.call\\(.*calldata", glob="**/*.sol")
Grep("bytes4.*selector|abi\\.encodePacked\\(.*selector", glob="**/*.sol")

Mitigation:

// Whitelist allowed selectors
mapping(bytes4 => bool) public allowedSelectors;

function execute(address target, bytes calldata data) external onlyOwner {
    bytes4 selector = bytes4(data[:4]);
    require(allowedSelectors[selector], "Selector not allowed");
    (bool success,) = target.call(data);
    require(success);
}

Pattern 6: Contract Address vs EOA

Root Cause: Missing Address Type Check

// VULNERABLE: Assumes EOA, but could be contract
function sendReward(address winner) external {
    payable(winner).transfer(reward);  // @audit Contract might reject ETH
}

// VULNERABLE: Assumes contract, but could be EOA
function callHook(address hook) external {
    IHook(hook).onAction();  // @audit EOA call succeeds silently (no code)
}

Search Queries:

Grep("\\.transfer\\(|\\.send\\(", glob="**/*.sol")
Grep("address\\.code\\.length|isContract", glob="**/*.sol")

Mitigation:

function sendReward(address winner) external {
    // Use call instead of transfer
    (bool success,) = winner.call{value: reward}("");
    require(success, "Transfer failed");
}

function callHook(address hook) external {
    require(hook.code.length > 0, "Not a contract");
    IHook(hook).onAction();
}

Pattern 7: Deadline/Timestamp Validation

Root Cause: Missing Temporal Bounds

// VULNERABLE: No deadline check
function swap(uint256 amountIn, uint256 minAmountOut) external {
    // Swap can execute at any time, even if price changed
    uint256 amountOut = _calculateSwap(amountIn);
    require(amountOut >= minAmountOut);
    // @audit Transaction pending for hours still executes
}

Mitigation:

function swap(
    uint256 amountIn,
    uint256 minAmountOut,
    uint256 deadline
) external {
    require(block.timestamp <= deadline, "Expired");
    // ...
}

Input Validation Checklist

Address Validation

• Zero address rejected where appropriate
• Self-address rejected if dangerous
• Contract vs EOA distinguished when needed
• Address format validated (if applicable)

Amount Validation

• Zero amounts handled appropriately
• Maximum bounds enforced
• Minimum bounds enforced
• Overflow impossible (Solidity 0.8+)

Array Validation

• Empty arrays rejected or handled
• Maximum length enforced
• Multiple array lengths match
• No out-of-bounds access

Temporal Validation

• Deadlines enforced for time-sensitive ops
• Future timestamps validated
• Past timestamps handled

Calldata Validation

• Selectors whitelisted if arbitrary calls
• Encoding validated
• Return data validated

Search Query Reference

# Find missing zero checks
Grep("address.*=|setAdmin|setOwner|set.*Address", glob="**/*.sol")
Grep("payable\\(.*\\)\\.transfer", glob="**/*.sol")

# Find parameter setters
Grep("function set.*external|function update.*external", glob="**/*.sol")
Grep("onlyOwner|onlyAdmin", glob="**/*.sol")

# Find array operations
Grep("\\[\\].*calldata|\\[\\].*memory", glob="**/*.sol")
Grep("\\.length", glob="**/*.sol")

# Find arbitrary calls
Grep("\\.call\\(|delegatecall\\(|staticcall\\(", glob="**/*.sol")

Severity Classification

Critical

• Zero address burns funds permanently
• Missing bounds allow fund drain
• Array mismatch causes fund loss

High

• Admin can set dangerous parameters
• Arbitrary call allows privilege escalation
• Missing deadline enables MEV extraction

Medium

• Zero amount wastes gas
• Missing contract check causes silent failure
• Timestamp edge cases

Rationalization Table (Reject These Excuses)