Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Address != address(0) check is not done

ua1552

Summary

No checks for address zero for the winners is done in the Distributor.sol contract.

Vulnerability Details

In _distribute function of the Distributor.sol the checks for address zero for the winners array is not done. The contract attempts to transfer funds to the winners in the loop below:

for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}

But for every address inside the winners array the checks are not done if the address of the winner is address zero or not. This can transfer the funds to address zero easily as SafeERC20.sol does not check for that as well.

Here is a test that proves that [Successfull transfer]: [Test]

Impact

Contract Can Lost the funds.

Tools Used

Manual Review

Recommendations

Add the check inside the for loop of _distribute function to check for the address zero in every iteration. An example code:

for (uint256 i; i < winnersLength;) {
if(winners[i] == address(0) revert Distribute__CannotTransferToAddressZero();
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!