[Pushers L01]Missing Zero-Address Check in Linea and Scroll Buffer Constructors

src/contracts/block-hash-pusher/linea/LineaBuffer.sol

@@ -33,12 +33,15 @@ contract LineaBuffer is BaseBuffer {
     error SenderMismatch();
 
     constructor(address l2MessageService_, address pusher_) {
-        _l2MessageService = l2MessageService_;
-        _pusher = pusher_;
-
         if (l2MessageService_ == address(0)) {
             revert InvalidL2MessageServiceAddress();
         }
+        if (pusher_ == address(0)) {
+            revert InvalidPusherAddress();
+        }
+
+        _l2MessageService = l2MessageService_;
+        _pusher = pusher_;
     }
 
     /// @inheritdoc IBuffer
@@ -48,9 +51,6 @@ contract LineaBuffer is BaseBuffer {
         if (msg.sender != address(l2MessageServiceCached)) {
             revert InvalidSender();
         }
-        if (_pusher == address(0)) {
-            revert InvalidPusherAddress();
-        }
         if (l2MessageServiceCached.sender() != _pusher) {
             revert SenderMismatch();
         }

src/contracts/block-hash-pusher/linea/LineaPusher.sol

@@ -21,7 +21,14 @@ contract LineaPusher is BlockHashArrayBuilder, IPusher {
         uint256 _fee;
     }
 
+    /// @notice Thrown when attempting to set an invalid Linea Rollup address.
+    error InvalidLineaRollupAddress();
+
     constructor(address rollup_) {
+        if (rollup_ == address(0)) {
+            revert InvalidLineaRollupAddress();
+        }
+
         _lineaRollup = rollup_;
     }
 

src/contracts/block-hash-pusher/scroll/ScrollBuffer.sol

@@ -30,12 +30,15 @@ contract ScrollBuffer is BaseBuffer {
     error InvalidSender();
 
     constructor(address l2ScrollMessenger_, address pusher_) {
-        _l2ScrollMessenger = l2ScrollMessenger_;
-        _pusher = pusher_;
-
         if (l2ScrollMessenger_ == address(0)) {
             revert InvalidL2ScrollMessengerAddress();
         }
+        if (pusher_ == address(0)) {
+            revert InvalidPusherAddress();
+        }
+
+        _l2ScrollMessenger = l2ScrollMessenger_;
+        _pusher = pusher_;
     }
 
     /// @inheritdoc IBuffer
@@ -45,9 +48,6 @@ contract ScrollBuffer is BaseBuffer {
         if (msg.sender != address(l2ScrollMessengerCached)) {
             revert InvalidSender();
         }
-        if (_pusher == address(0)) {
-            revert InvalidPusherAddress();
-        }
         if (l2ScrollMessengerCached.xDomainMessageSender() != _pusher) {
             revert DomainMessageSenderMismatch();
         }

src/contracts/block-hash-pusher/scroll/ScrollPusher.sol

@@ -23,7 +23,14 @@ contract ScrollPusher is BlockHashArrayBuilder, IPusher {
         address refundAddress;
     }
 
+    /// @notice Thrown when attempting to set an invalid L1ScrollMessenger address.
+    error InvalidL1ScrollMessengerAddress();
+
     constructor(address l1ScrollMessenger_) {
+        if (l1ScrollMessenger_ == address(0)) {
+            revert InvalidL1ScrollMessengerAddress();
+        }
+
         _l1ScrollMessenger = l1ScrollMessenger_;
     }
 

src/contracts/block-hash-pusher/zksync/ZkSyncBuffer.sol

@@ -41,9 +41,6 @@ contract ZkSyncBuffer is BaseBuffer {
 
     /// @notice The aliased address of the pusher contract on L2.
     function aliasedPusher() public view returns (address) {
-        if (_pusher == address(0)) {
-            revert InvalidPusherAddress();
-        }
         return AddressAliasHelper.applyL1ToL2Alias(_pusher);
     }
 }

src/contracts/block-hash-pusher/zksync/ZkSyncPusher.sol

@@ -30,6 +30,9 @@ contract ZkSyncPusher is BlockHashArrayBuilder, IPusher {
     /// @notice Thrown when the L2 transaction request fails.
     error FailedToPushHashes();
 
+    /// @notice Thrown when attempting to set an invalid ZkSync Diamond address.
+    error InvalidZkSyncDiamondAddress();
+
     /// @notice Parameters for the L2 transaction that will be executed on ZkSync.
     /// @param l2GasLimit The gas limit for the L2 transaction.
     /// @param l2GasPerPubdataByteLimit The gas per pubdata byte limit.
@@ -41,6 +44,10 @@ contract ZkSyncPusher is BlockHashArrayBuilder, IPusher {
     }
 
     constructor(address zkSyncDiamond_) {
+        if (zkSyncDiamond_ == address(0)) {
+            revert InvalidZkSyncDiamondAddress();
+        }
+
         _zkSyncDiamond = zkSyncDiamond_;
     }
 

test/block-hash-pusher/linea/LineaBuffer.t.sol

@@ -50,6 +50,16 @@ contract LineaBufferTest is Test {
         buffer.receiveHashes(1, new bytes32[](1));
     }
 
+    function test_constructor_reverts_if_pusher_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(LineaBuffer.InvalidPusherAddress.selector));
+        new LineaBuffer(address(mockLineaMessageService), address(0));
+    }
+
+    function test_constructor_reverts_if_l2_message_service_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(LineaBuffer.InvalidL2MessageServiceAddress.selector));
+        new LineaBuffer(address(0), pusher);
+    }
+
     function testFuzz_receiveHashes_reverts_if_sender_does_not_match_pusher(address notPusher) public {
         vm.assume(notPusher != pusher);
         LineaBuffer buffer = new LineaBuffer(address(mockLineaMessageService), pusher);

test/block-hash-pusher/linea/LineaPusher.t.sol

@@ -80,6 +80,11 @@ contract LineaPusherTest is Test {
         lineaPusher.pushHashes(buffer, block.number - batchSize, batchSize, l2TransactionData);
     }
 
+    function test_constructor_reverts_if_rollup_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(LineaPusher.InvalidLineaRollupAddress.selector));
+        new LineaPusher(address(0));
+    }
+
     function test_viewFunctions() public {
         LineaPusher lineaPusher = new LineaPusher(mockLineaRollup);
         assertEq(lineaPusher.lineaRollup(), mockLineaRollup);

test/block-hash-pusher/scroll/ScrollBuffer.t.sol

@@ -38,6 +38,16 @@ contract ScrollBufferTest is Test {
         mockL2ScrollMessenger.relayMessage(pusher, address(buffer), 0, 0, l2Calldata);
     }
 
+    function test_constructor_reverts_if_pusher_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(ScrollBuffer.InvalidPusherAddress.selector));
+        new ScrollBuffer(address(mockL2ScrollMessenger), address(0));
+    }
+
+    function test_constructor_reverts_if_l2_scroll_messenger_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(ScrollBuffer.InvalidL2ScrollMessengerAddress.selector));
+        new ScrollBuffer(address(0), pusher);
+    }
+
     function testFuzz_receiveHashes_reverts_if_sender_is_not_l2_scroll_messenger(address notL2ScrollMessenger) public {
         vm.assume(notL2ScrollMessenger != address(mockL2ScrollMessenger));
         ScrollBuffer buffer = new ScrollBuffer(address(mockL2ScrollMessenger), pusher);

test/block-hash-pusher/scroll/ScrollPusher.t.sol

@@ -63,6 +63,11 @@ contract ScrollPusherTest is Test {
         scrollPusher.pushHashes(buffer, block.number - batchSize, batchSize, l2TransactionData);
     }
 
+    function test_constructor_reverts_if_l1_scroll_messenger_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(ScrollPusher.InvalidL1ScrollMessengerAddress.selector));
+        new ScrollPusher(address(0));
+    }
+
     function test_viewFunctions() public {
         ScrollPusher scrollPusher = new ScrollPusher(mockL1ScrollMessenger);
         assertEq(scrollPusher.l1ScrollMessenger(), mockL1ScrollMessenger);

test/block-hash-pusher/zksync/ZkSyncBuffer.t.sol

@@ -30,6 +30,11 @@ contract ZkSyncBufferTest is Test {
         buffer.receiveHashes(firstBlockNumber, blockHashes);
     }
 
+    function test_constructor_reverts_if_pusher_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(ZkSyncBuffer.InvalidPusherAddress.selector));
+        new ZkSyncBuffer(address(0));
+    }
+
     function testFuzz_receiveHashes_reverts_if_not_pusher(address notPusher) public {
         vm.assume(notPusher != pusher);
         address aliasedPusher = AddressAliasHelper.applyL1ToL2Alias(pusher);

test/block-hash-pusher/zksync/ZkSyncPusher.t.sol

@@ -98,6 +98,11 @@ contract ZkSyncPusherTest is Test {
         zkSyncPusher.pushHashes(buffer, block.number - batchSize, batchSize, l2TransactionData);
     }
 
+    function test_constructor_reverts_if_zksync_diamond_is_zero_address() public {
+        vm.expectRevert(abi.encodeWithSelector(ZkSyncPusher.InvalidZkSyncDiamondAddress.selector));
+        new ZkSyncPusher(address(0));
+    }
+
     function test_viewFunctions() public {
         ZkSyncPusher zkSyncPusher = new ZkSyncPusher(mockZkSyncMailbox);
         assertEq(zkSyncPusher.zkSyncDiamond(), mockZkSyncMailbox);