No Address(0) Check for removeCollateralNative
Summary
The function removeCollateralNative has no check for sending funds to address(0) which allows the owner to effectively burn their native tokens on accident.
Vulnerability Details
There is an unsafe arbitrary call execution to a user input address. Should the owner be able to remove their native collateral by having sufficient collateral, and the owner provides no calldata for the _to variable, the function will execute and send the user's funds to the default address effectively burning their funds.
Impact
Potential loss of all native tokens in the vault.
Tools Used
Manual Review
Recommendations
Add a check that the _to address is not address(0) as is best practice, or specify the recipient as msg.sender or the owner.
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.