> For the complete documentation index, see [llms.txt](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simones-organization-4.gitbook.io/hackbook-of-a-hacker/smart-contracts-security/code4rena/high-risk-findings/signature-verification-can-be-bypass-with-zero-address.md).

# Signature Verification Can Be Bypass With Zero Address

Submitted by (4) vlad\_bochok, also found by indijanc, Lambda, and wastewa

### Summary:

<https://code4rena.com/reports/2022-08-rigor/#h-05-add-members-to-the-not-yet-created-community>

Anyone can add himself as a member of community for any future community. This can be done due to a combination of facts:

* Non initialized address storage values are defaulted to `address(0)`
* `addMember` doesn't check if community is already created
* `checkSignatureValidity` doesn't check for `address(0)`

### Mitigation:

1. `checkSignatureValidity`/`recoverKey` should revert the call if an `address == 0`.
2. `addMember` should have a `require(_communityId <= communityCount)`

### TAGS: #sig