TSender

Summary

Unchecking the validity of the token address makes the validation process kind of weak

Vulnerability Details

areListsValid() function should validate that the input that the user for AirDropping will put is valid, this is by checking 0 amounts, address(0) and duplications. However, there is no check for the provided tokenAddress is it a real contract address and an ERC20.

This makes the validation process not complete as this part is not handled in airdropERC20() too. So if the tokenAddress is an EOA address for example (Writing the contract address and mistaking in one character or something), the function will get executed, consuming gas, without any action.

Impact

Possibility of making calls to EOAs by mistake and wasting gas executing useless TX

Tools Used

Manual Review

Recommendations

Add another parameter in areListsValid which takes the token address. and check that the address is a Contract address. A more robust check will be to check for decimal interface for example, to be sure it is an ERC20 token.