Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Zero token transfers in Distributor contract

Silver Hawks

Summary

The Distributor contract doesn't check for zero value token transfers, which may cause a revert for certain ERC-20 implementations.

Vulnerability Details

During the execution of the distribute() function, ERC20 tokens are transferred to winners and to the stadium address as part of the protocol's fee.

In both of these cases, there is no check if the resulting amount is greater than zero prior to executing the transfer. If any of these amounts gets rounded down to zero, the process may be blocked due to a revert in the ERC20 transfer call.

Impact

Low. The amount or percentage needs to be low enough so that it gets rounded to zero.

Tools Used

None.

Recommendations

Add to check to execute the transfer only when the amount is greater than zero.

for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
+ if (amount > 0) {
erc20.safeTransfer(winners[i], amount);
+ }
unchecked {
++i;
}
}
​
function _commissionTransfer(IERC20 token) internal {
- token.safeTransfer(STADIUM_ADDRESS, token.balanceOf(address(this)));
+ uint256 balance = token.balanceOf(address(this));
+ if (balance > 0) {
+ token.safeTransfer(STADIUM_ADDRESS, balance);
+ }
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.