Submission Details
Severity:
[L-03] Missing Zero Address check in MysteryBox::transferReward, rewards can be burnt by players
Summary
There is no check that the address the player is transferring the reward to is not the the zero address. Therefore, this reward can be burnt by the player.
Impact
Player's rewards can be sent to the zero address, meaning they can never be redeemed. This will lead to a bad user experience if a player accidentally does this.
Tools Used
Manual review
Recommended Mitigation
Add check for the _to address to ensure it is not the zero address.
function transferReward(address _to, uint256 _index) public {
+ require(_to != address(0), "attempted to burn reward");
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
delete rewardsOwned[msg.sender][_index];
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.