Submission Details
Severity:
tokenCollateralAddress not checked
Summary
The tokenCollateralAddress in _redeemCollateral() function of DSCEngine.sol is not checked to be valid
Vulnerability Details
The tokenCollateralAddress passed as argument can be invalid causing the function to fail.
Impact
A user can pass an incorrect tokenCollateralAddress causing function to revert.
Tools Used
Manual review
Recommendations
The following can be used to check for valid address
function _redeemCollateral(address tokenCollateralAddress, uint256 amountCollateral, address from, address to)
private
{
if (s_collateralTokens[tokenCollateralAddress] == address(0)) {
revert DSCEngine__NotAllowedToken();
}
s_collateralDeposited[from][tokenCollateralAddress] -= amountCollateral;
emit CollateralRedeemed(from, to, tokenCollateralAddress, amountCollateral);
bool success = IERC20(tokenCollateralAddress).transfer(to, amountCollateral);
if (!success) {
revert DSCEngine__TransferFailed();
}
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.