# Unvalidated config address disables feature

Caller-supplied store, guard, or module address accepted without allowlist, silently breaking slashing or hooks

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2026-10-23. Updated 2026-10-24._

## How it works
A security-critical component trusts a configuration value (an address, a boolean, a module reference) that the caller or an untrusted source controls, without checking it against the protocol's own allowlist or trust filter. The feature then either points at a wrong target or refuses to run, and the failure is silent: no revert at configuration time, only later when the security action is attempted. The broken assumption is that "config was set by someone authorized and points at a valid component." When that assumption is false, the guard, slashing handler, or path check is effectively absent.

## Where it shows up
- Factory or deploy function passing user-supplied `extraData`/init params into `initialize()` without validating each field against a protocol mapping [E2](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-02.md)
- A security-critical read that uses a plain accessor while sibling reads in the same module use a filtered/trusted variant [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q54r-jf2p-rfr2.md)
- Stored-vs-passed equality checks where the stored side is caller-controlled [E2](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-02.md)
- Integration points where an external contract added a new interface requirement (e.g. EIP-165) the local component does not satisfy [E3](https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md)
- Guard/module setters that accept any address rather than a whitelisted one

## How to review
For every config value that gates a security action, trace where it is set and confirm it is validated against a protocol-level allowlist or trust filter at set time, not just used later. The invariant: any address or flag that determines whether slashing, hooks, or path checks run must come from a trusted source or match a whitelisted mapping before it is stored. Diff each security-sensitive read against its siblings; a single unfiltered accessor reopens the boundary [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q54r-jf2p-rfr2.md). For external integrations, check the dependency's changelog for newly required interfaces [E3](https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md).

## Variants seen
- Untrusted repo config disables path-protection checks via an unfiltered boolean read [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-q54r-jf2p-rfr2.md)
- Operator-supplied slashStore mismatches the whitelisted handler, making the vault unslashable [E2](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-02.md)
- Guard lacks EIP-165 support, so setGuard reverts and integration breaks [E3](https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md)

## Impact and severity
Silently disables a protective feature: unslashable vaults, disabled path-confusion checks enabling hook overwrite, or broken guard installation. Severity is high where the disabled feature is the last line of defense; worse when the failure is silent and only surfaces at the moment protection is needed.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-q54r-jf2p-rfr2.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md