Submission Details
Severity:
The `winners` addresses are not checked if it is zero address
Summary
In the function distribute, the addresses array of winners are passed as an input. But there is no sanity check provided to check if any of the address is zero.
Vulnerability Details
The distribute function in the contract Distributor takes the winners addresses but if any of the address is zero address. The distribute function will transfer the amount to that address. Which will lead to loss of the funds to a unrecoverable address.
Impact
Loss of funds by mistake.
Tools Used
Manual Review
Recommendations
Add the following line of code in the internal function _distribute
+ uint256 winnersLength = winners.length;
+ for(uint256 i; < winnersLength;) {
+ if(winners[i] == address(0)) revert Distributor__NoZeroAddress();
+ unchecked {
+ i++;
+ }
+ }
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.