Project

Summary:

The sendProfit function allows users to send a profit amount to the contract, which either updates the contract's totalProfit if the total supply is non-zero or redirects the amount to the creator if the supply is zero. However, the function lacks validation for zero amounts, which can result in unnecessary gas consumption and redundant transactions.

Vulnerability Details:

Zero Amount Handling: The function does not check if the amount is zero before proceeding with transfers and state updates. This allows transactions with zero value to pass through, leading to unnecessary state changes and token transfers without any meaningful effect.

• When amount == 0, the contract still updates the totalProfit variable, potentially modifying the state and consuming gas.

• A safeTransferFrom is invoked even though the amount is zero, resulting in wasted gas without transferring any tokens.

Impact:

Gas Inefficiency: The lack of validation for zero amounts results in unnecessary state changes and transfers. This causes an increase in transaction costs without any corresponding benefit.

• Redundant Transactions: Zero-value transfers may be initiated, clogging the transaction pool and leading to excessive and unnecessary contract interactions, potentially causing increased load on the blockchain and making the contract less efficient.

Tools Used:

Manual inspection of contract logic.

Recommendations:

Zero Amount Validation: Add an explicit check at the beginning of the function to revert if amount == 0 to prevent unnecessary state changes and transfers.