deth_ctf - owner can be address(0)

[ghost]

Description of the Bug:

The constructor of Vault takes an address param _owner which is not checked if it is address(0). Thus, the public state variable owner can be set to address(0)

Impact

Malicious user can create Vaults with wrong address values

Solution:

Check for address(0) when assigning values to address state variables.

[0xdeth]

Owner is always msg.sender.