Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Some ERC20 tokens may revert on zero value transfers

peanuts

Summary

Some ERC20 tokens may revert on zero value transfers. When distributing tokens to winners and STADIUM_ADDRESS, if the transfer value is zero, then the whole transaction will be reverted.

Vulnerability Details

In Distributor.sol, the organizer will distribute tokens according to the percentages the winners earned.

uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);

In the case where the winner actually earns a zero amount and the ERC20 reverts on zero-value transfer, then the whole distribute function will be DoSed. Also, if the commission fee is set to zero in the future, then the STADIUM_ADDRESS may receive 0 tokens.

uint256 private constant COMMISSION_FEE = 500; // this can be changed in the future
function _commissionTransfer(IERC20 token) internal {
token.safeTransfer(STADIUM_ADDRESS, token.balanceOf(address(this))); //@audit -> address may receive 0 tokens
}

Impact

Distribution of tokens may be DoSed when interacting with ERC20 tokens that revert on zero-value transfer

Tools Used

Manual Review

Recommendations

It is best to account for any potential revert on zero-value transfer tokens even if the current protocol doesn't use those tokens because the whitelisted tokens may change if they are upgraded or if the owner decides to revamp the protocol to allow more whitelisted tokens.

Check for zero value transfer:

uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
+ if(amount > 0){
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
}
function _commissionTransfer(IERC20 token) internal {
+ uint amount = token.balanceOf(address(this));
+ if(amount > 0){
token.safeTransfer(STADIUM_ADDRESS, token.balanceOf(address(this)));
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.