Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Zero Address Validation

maroutis

Summary

The _distribute function does not verify valid winner addresses, potentially leading to funds being sent to the null address.

Vulnerability Details

A user might submit a faulty 0 address by mistake or the organizer might call the deployProxyAndDistribute function with a faulty zero address for a winner. When the _distribute is called, it sends funds to the winner's address https://github.com/Cyfrin/2023-08-sparkn/blob/0f139b2dc53905700dd29a01451b330f829653e9/src/Distributor.sol#L147. But nowhere in the function, does the function checks for the validity of the winner's addresses.

Impact

This might incure loss of funds for the winner.

Tools Used

Manual review

Recommendations

Change the following code : https://github.com/Cyfrin/2023-08-sparkn/blob/0f139b2dc53905700dd29a01451b330f829653e9/src/Distributor.sol#L145-L150
To :

for (uint256 i; i < winnersLength;) {
if (winners[i] != address(0)) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
}
unchecked {
++i;
}
}

That way, the funds will not be lost and the winner can be contacted to change his address.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!