15,000 USDC
Submission Details
Severity:
sweepAll() function does not check the receiver not to be address(0)
Summary
In MErc20DelegateMadFixer contract, the sweepAll() function does not check that receiver is not address(0).
Vulnerability Details
Executing the function with address(0) as parameter will literally burn all the underlying tokens and make them impossible to recover. Not checks are made in this function nor the ones called by this (e.g. token.transfer()) to prevent this from happenning.
Impact
Low impact. It does not affect the operation of the protocol but introduces the possibility of burning all the underlying tokens.
Tools Used
Manual review
Recommendations
Add a check for address(0):
function sweepAll(address sweeper) external {
//@audit does not check for address(0)
/// @dev checks
require(msg.sender == admin, "only admin may sweep all");
+ require(sweeper != address(0), "sweeper cannot be address(0)");
EIP20Interface token = EIP20Interface(underlying);
/// @dev take it, take it all
bool success = token.transfer(sweeper, token.balanceOf(address(this)));
require(success, "token sweep failed");
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.