Submission Details
Severity:
Lack of check for user input address != address(0)
Summary
Lack of check for user input address != address(0) in Ownable.transferOwnership(), Fees.constructor() and Lender. setFeeReceiver().
Vulnerability Details
Bob calls transferOwnership() with a wrong _owner address, so Bob loses ownership of the contract.
Impact
Wrong user input can lead to loss of contract ownership or wrong token addresses in Fees.sol or useless expensive external call costing gas in setFeeReceiver() if the owner has to call it again to set it to the right address.
Tools Used
Manual review
Recommendations
Check that the address is not zero.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.