> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.getfoundry.sh/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

## Missing zero-address check

**Severity**: `Low`
**ID**: `missing-zero-check`

Flags entry-point functions and constructors where an `address` parameter flows into a state write
or value transfer without a zero-address guard.

### What it does

Performs a taint analysis from each `address` parameter of an externally callable, state-mutating
function (or constructor) and reports a parameter that reaches a sink (state write, `transfer`,
`call{value: ...}`, etc.) without first being compared against `address(0)` in an `if`/`require`/
`assert` predicate.

### Why is this bad?

Forgetting a zero-address check is a common source of value loss: tokens become permanently
unrecoverable, ownership is renounced unintentionally, or upgrades are bricked. Adding an explicit
guard is cheap and removes an entire class of operational mistakes.

### Example

#### Bad

```solidity
function setOwner(address newOwner) external onlyOwner {
    owner = newOwner; // no zero-address check
}
```

#### Good

```solidity
function setOwner(address newOwner) external onlyOwner {
    require(newOwner != address(0), "zero address");
    owner = newOwner;
}
```