Submission Details
Severity:
No token address validation
Summary
No token address validation
Vulnerability Details
With 0x0 adress contract still accept and transfers and can waste gas .There's no zero address check even in areListsValid which can be set and evade this problem
function test_airDropErc20ToManyByMaliciousUser() public virtual {
address sender=makeAddr("sender");
// Arrange
uint256 uint256Amount = 1 ether;
uint256 expectedTotalAmount = (uint256Amount * 2) + ONE;
vm.startPrank(sender);
mockERC20.mint(expectedTotalAmount);
mockERC20.approve(address(tSender), expectedTotalAmount);
vm.stopPrank();
address[] memory recipients = new address[](2);
recipients[0] = recipientOne;
recipients[1] = recipientTwo;
uint256[] memory amounts = new uint256[](2);
amounts[0] = uint256Amount;
amounts[1] = uint256Amount + ONE;
// Act maliciousUser
vm.prank(sender);
tSender.airdropERC20(address(0), recipients, amounts, expectedTotalAmount);
}
Impact
Loss of gas
Tools Used
Manuel review
Recommendations
set validation inside areListsValid function.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
25659 USDC / LOC
12,500 USDC
1,375 USDC
1,125 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.