Submission Details
Severity:
Zero address can claim auction token
Summary
The claimfunction in the SpiceAuctiontoken can be called by a zero address. The token is unintentionally burnt if this happens!
Vulnerability Details
Here is the vulnerable line of code in the said function:
IERC20(auctionToken).safeTransfer(msg.sender, claimAmount);
Before this line, there was no check to checkmate a zero address. Which means a zero address can successfully claim theauctionToken.
Impact
Unintentional token burning as the claimed auctionTokencan neither be accessed nor recovered.
Tools Used
Manual review.
Recommendations
include a custom error that stops a zero address from claiming the tokens.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.