Submission Details
Severity:
Lack of zero address validation in `MysteryBox::transferReward` function leads to permanent loss of rewards
Summary
The transferReward function lacks validation for the zero address, allowing rewards to be transferred to an inaccessible address, leading to permanent loss of rewards without affecting the overall contract security.
Impact
The lack of zero address validation can result in permanent loss of rewards if sent to the zero address.
Tools Used
Manual code review
Recommendations
Add zero address validation.
function transferReward(address _to, uint256 _index) public {
+ require(_to != address(0), "Cannot transfer to the zero address");
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
delete rewardsOwned[msg.sender][_index];
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.