Zaros Part 1

Summary

The notifyAccountTransfer function in the TradingAccountBranch contract does not validate the to address parameter when transferring ownership of a trading account. This oversight allows the possibility of transferring an account to a zero address or any unintended address, which could lead to significant issues in account management and security.

Vulnerability Details

In the TradingAccountBranch contract, the notifyAccountTransfer function is used to update the ownership of a trading account. The function is intended to be called by the Account NFT contract to notify the system of an account transfer. The notifyAccountTransfer function updates the owner field of the TradingAccount data structure to the new address provided. However, there is no validation to ensure that the to address is not a zero address or an unintended address. If the to address is the zero address (0x0), the account ownership will be lost, as there will be no owner to manage or access the account.

See the following code:

Impact

Accounts can be transferred to a zero address, resulting in the permanent loss of ownership and control over those accounts. This vulnerability can compromise the integrity of the account management system and potentially lead to financial losses or disruptions in trading activities.

Tools Used

Manual Review

Recommendations

To mitigate this issue, the notifyAccountTransfer function should be updated to include validation checks for the to address. The function should ensure that the to address is neither the zero address nor any other invalid address.