Submission Details
Severity:
[H-1] Lack of checks in `KittyConnect::addShop`
Summary
Missing validations and checks of shopAddress in KittyConnect::addShop
function addShop(address shopAddress) external onlyKittyConnectOwner {
s_isKittyShop[shopAddress] = true;
s_kittyShops.push(shopAddress);
emit ShopPartnerAdded(shopAddress);
}
Vulnerability Details
Not validating shopAddress allows a potential attacker to set shopAddress to the 0x0 address or add duplicate addresses.
Impact
Due to the lack of checks in KittyConnect::addShop, that might result in casuing unintended consequences such as loss of funds or failure of transactions that depend on a valid shop address.
Tools Used
Manual Review
Recommendations
function addShop(address shopAddress) external onlyKittyConnectOwner {
+ require(shopAddress != address(0), "Invalid shop address");
+ require(!s_isKittyShop[shopAddress], "Shop address already exists");
s_isKittyShop[shopAddress] = true;
s_kittyShops.push(shopAddress);
emit ShopPartnerAdded(shopAddress);
}
Rewards breakdown
nSLOC
235This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.