Submission Details
Severity:
No Zero Address check in constructor
Summary
SantaToken's constructor does not check for zero address before deployment.
Vulnerability Details
At construction time, SantaToken stores the contract address of SantasList as immutable. i_santasList is the only authority that interacts with mint and burn and it's value cannot be changed after deployment. There is no check to verify if the i_santaList is a valid address.
Impact
No access to mint and burn functionality in SantaToken
Tools Used
Manual Review.
Recommendations
Since this contract is deployed by SantaToken itself, set i_santasList to msg.sender.
constructor() ERC20("SantaToken", "SANTA", DECIMALS) {
i_santasList = msg.sender;
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.