This is a low risk vulnerability due to the fact that it is possible to lose funds if the Base address is set to a zero address and someone sends funds to this address. As a rule, there should always be checks to make sure that initialized addresses are never a zero address.
According to Slither analysis documentation (https://github.com/crytic/slither/wiki/Detector-Documentation#exploit-scenario-49), there needs to be a zero address checkpoint when initializing a base address in a contract. In the case for BondVault, the constructor initializes a base address. There should be a check to make sure this address is never zero to make sure there is no way to lose funds.
Slither detector:
missing-zero-check:
BondVault.constructor(address)._base (contracts/BondVault.sol#37) lacks a zero-check on : BASE = _base (contracts/BondVault.sol#38)
See issue page for Slither output from console (JSON format):
Recommend:
verifyfirst (Spartan) acknowledged
