Submission Details
Severity:
accidental loss of user rewards when using `transferReward()` function
Summary
Users can mistakenly transfer rewards to the zero address when using the transferReward() function resulting in loss of funds.
Vulnerability Details
The transferReward()function is missing a zero address check for the _to parameter input when a user transfers their rewards, resulting in accidental loss of funds.
Impact
Loss of user funds to the zero address.
Tools Used
Manual review.
Recommendations
Apply a requirestatement to the function to avoid accidental loss of user funds when using the function to transfer rewards.
function transferReward(address _to, uint256 _index) public {
+ require(_to != address(0), "Cannot trasnfer to address(0).")
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
delete rewardsOwned[msg.sender][_index];
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.