Submission Details
Severity:
Missing zero address check for winners
Summary
_distribute function missing the zero address check for winners parameter, which could may lead to loss of fund
Vulnerability Details
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
// audit: need check winners[i] is not zero address
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
Impact
loss of fund
Tools Used
Manual review
Recommendations
Add zero address check for zero address for winner before send token.
uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
if (winners[i] == address(0)) revert Distributor__NoZeroAddress();
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.