Submission Details
Severity:
```SantaToken::santasList``` address - zero-check address missing
Summary
The constructor of the SantaToken contract does not prevent the santasList address from being set to 0x0.
Vulnerability Details
//SantaToken.sol
constructor(address santasList) ERC20("SantaToken", "SANTA", DECIMALS) {
@> i_santasList = santasList;
}
Impact
The santasList address is used in the mint and burn functions of the SantaToken contract. If the santasList address is mistakenly set to 0x0, any tokens minted or burned are irretrievably lost.
Tools Used
slither
Recommendations
Add a check in the constructor of the SantaToken contract to ensure that the santasList address cannot be set to 0x0.
constructor(address santasList) ERC20("SantaToken", "SANTA", DECIMALS) {
+ require(santasList != address(0), "SantasList address cannot be 0x0");
i_santasList = santasList;
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.