Vulnerability Details

Impact

Fees.sellProfits() is missing a zero address check for staking and _profits parameter, which could may allow transferring WETH balance of the contract to address 0 in which will remain locked. Considering that staking parameter is set in constructor, the chance of setting its_staking parameter to zero address is low, so this should be low risk vulnerability.

Tools Used

Manual Review

Recommendations

Add a require() check for zero address for staking and _profits parameters before transferring.