Submission Details
Severity:
Missing Address 0 Check in Winners List:
Summary
The function performs token transfers to addresses in the winners array without checking if any of the addresses are 0x0 (address 0).
Vulnerability Details
This could lead to accidental loss of tokens, as transferring tokens to address 0 results in a burn.
Impact
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS; // @audit-issue amount checks
erc20.safeTransfer(winners[i], amount); // @audit-issue no address 0 checks when doing safeTransfer
unchecked {
++i;
}
}
Tools Used
Manual review
Recommendations
To mitigate this, you should add a check to ensure that the addresses in the winners array are not address 0 before proceeding with the token transfer.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.