Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Possible Lockup tokens in contract forever

b353n

Summary

ERC20 Tokens like USDT and USDC can be locked forever in proxy contract if someone from winners is blacklisted.

Vulnerability Details

The vulnerabilities are identified in the Distributor.sol in function _distribute. If someone frim winners is blacklisted by ERC20 tokens like USDT and USDC the _distribute function will always revert and tokens will be lock in contract forever since there no have rescue function. Addictional in ProxyFactory.sol have function deployProxyAndDistributeByOwner which suppouse to be used to rescue stucked tokens in some of proxies but because this function will call again _distribute function in Distributor.sol result will be the same and tokens will be locked there forever.

Impact

These vulnerabilities have the potential to lead to substantial financial losses and disrupt the intended functionality of the Sparkn Protocol. Tokens can be inadvertently locked, making them unrecoverable, and attempts to rescue them through the owner's actions will also fail.

Tools Used

Manual Review

Recommendations

Adding rescue function in Distributor.sol to can owner withdraw tokens stuck in proxy contracts like

function rescue(IERC20 _token, address to) external onlyOwner {
uint256 balance = _token.balanceOf(address(this));
_token.safeTransfer(to, balance);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.