15,000 USDC
Submission Details
Severity:
mip-m17.sol proposal contract may read zero addresses from .json files and it will pass
Summary
There are no zero address checks for addresses being read in .json files.
Vulnerability Details
Same as summary - corrupt .json file leads to vulnerabilities.
POC
Add or replace some object in mFRAX.json with following and run integration test:
{
"addr": "0x0000000000000000000000000000000000000000"
},
it will pass.
Impact
Funds are at risk of being lost, and entire proposal is at stake of not executing properly.
Tools Used
Manual review
Recommendations
Ensure no address from .json file is a zero address. Ensure that in an on-chain check after reading from the .json file.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.