60,000 USDC
Submission Details
Severity:
No 0 address check present in `Starklane::depositTokens` function, one can transfer token to arbitrary address on L2
Vulnerability Details
The Starklane::depositTokens doesn't check for 0 address for the function parameter snaddress ownerL2.
if (!Cairo.isFelt252(snaddress.unwrap(ownerL2))) {
//unrwaps the L2 owner address to check if it is a felt252
revert CairoWrapError();
}
This check just ensures if the value is a felt252 or not, 0 address check is not done.
Impact
It can transfer tokens to an unexpected address on L2.
Tools Used
Manual review
Recommendations
Check for 0 address input.
require(ownerL2 != 0, "Invalid address");
Updates
Lead Judging Commences
n0kto 9 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Informational / Gas
Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.