Submission Details
Severity:
Missing address(0) check in `transferReward` function
Summary
missing address check can transfer reward to address 0
Vulnerability Details
if by mistakenly the transfer reward function is called to send reward to address(0) then that reward is getting wasted
Tools Used
manual
Recommendations
function transferReward(address _to, uint256 _index) public {
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
+ require(_to != address(0));
rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);
delete rewardsOwned[msg.sender][_index];
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.