Submission Details
Severity:
There is no check for 0 address when calling distribute function
Summary
If address 0 is included in the winners list, the tokens will be lost
Vulnerability Details
Not checking for 0 address among the winners may result in loss of tokens when trying to distribute prizes among the winners, if such a winner appears in the list
Impact
Loss of tokens
Tools Used
manual
Recommendations
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
require(winners[i] != 0); // ADD
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.