audit: don't allow adding/removing registries with no verification gateway

solidity/src/authorization/Authorization.sol

@@ -558,6 +558,11 @@ contract Authorization is Ownable, ICallback, ReentrancyGuard {
         bytes32[] calldata vks,
         bool[] memory validateBlockNumber
     ) external onlyOwner {
+        // Check that the verification gateway is set
+        if (address(verificationGateway) == address(0)) {
+            revert("Verification gateway not set");
+        }
+
         // Since we are allowing multiple registries to be added at once, we need to check that the arrays are the same length
         // because for each registry we have a list of users, a verification key and a boolean
         // Allowing multiple to be added is useful for gas optimization
@@ -584,6 +589,11 @@ contract Authorization is Ownable, ICallback, ReentrancyGuard {
      * @param registries Array of registry IDs to be removed
      */
     function removeRegistries(uint64[] memory registries) external onlyOwner {
+        // Check that the verification gateway is set
+        if (address(verificationGateway) == address(0)) {
+            revert("Verification gateway not set");
+        }
+
         for (uint256 i = 0; i < registries.length; i++) {
             // Remove the registry from the verification gateway
             verificationGateway.removeRegistry(registries[i]);

solidity/test/authorization/AuthorizationZK.t.sol

@@ -244,6 +244,46 @@ contract AuthorizationZKTest is Test {
         vm.stopPrank();
     }
 
+    function test_RevertWhen_AddRegistriesNoVerificationGateway() public {
+        vm.startPrank(owner);
+
+        // Deploy a new authorization contract without a verification gateway
+        Authorization authWithoutGateway = new Authorization(owner, address(processor), address(0), true);
+
+        // Create registry data
+        uint64[] memory registries = new uint64[](1);
+        registries[0] = registryId1;
+
+        address[][] memory users = new address[][](1);
+        users[0] = new address[](1);
+        users[0][0] = user1;
+
+        bytes32[] memory vks = new bytes32[](1);
+        vks[0] = vk1;
+
+        bool[] memory validateBlockNumbers = new bool[](1);
+        validateBlockNumbers[0] = validateBlockNumber1;
+
+        // Should fail because verification gateway is not set
+        vm.expectRevert("Verification gateway not set");
+        authWithoutGateway.addRegistries(registries, users, vks, validateBlockNumbers);
+
+        vm.stopPrank();
+    }
+
+    function test_RevertWhen_RemoveRegistriesNoVerificationGateway() public {
+        vm.startPrank(owner);
+
+        // Deploy a new authorization contract without a verification gateway
+        Authorization authWithoutGateway = new Authorization(owner, address(processor), address(0), true);
+
+        // Should fail because verification gateway is not set
+        vm.expectRevert("Verification gateway not set");
+        authWithoutGateway.removeRegistries(new uint64[](1));
+
+        vm.stopPrank();
+    }
+
     // ======================= ZK MESSAGE EXECUTION TESTS =======================
 
     function test_RevertWhen_VerificationGatewayNotSet() public {