Submission Details
Severity:
`christmasDinner:: deposit` Missing Zero amount validation could lead to accounting issues and unnecessary gas consumption.
**Description:** `deposit()` function accepts any amount, including zero without validation.This means users can execute transactions that have no actual value transfer but still modify contract state and emit events
```javascript
function deposit(address _token, uint256 _amount) external beforeDeadline {
if(!whitelisted[_token]) {
revert NotSupportedToken();
}
// No validation of _amount
if(participant[msg.sender]){
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
//
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
//written participant can not sign up others
//NewSignup emitted but no logic to sign up another person
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
```
**Impact:**
Complicates accounting and auditing processes
Users can create meaningless transactions that waste gas.
**Proof of Concept:**
<details>
<summary>Proof of Code</summary>
function testZeroAmountDeposit() public {
// This will succeed in current implementation
vm.startPrank(alice);
wbtc.approve(address(cd), 0);
cd.deposit(address(wbtc), 0);
vm.stopPrank();
// Event is emitted and state is modified for a zero transfer
assertTrue(cd.getParticipationStatus(alice));
}
</details>
**Recommended Mitigation:**
Implement zero amount validation at the beginning of the function:
Add validation for token address to prevent zero address deposits
Consider implementing maximum deposit limits
```diff
function deposit(address _token, uint256 _amount) external beforeDeadline {
+ require(_amount > 0, "Amount must be greater than zero")
if(!whitelisted[_token]) {
revert NotSupportedToken();
}
if(participant[msg.sender]){
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
emit GenerousAdditionalContribution(msg.sender, _amount);
} else {
//
participant[msg.sender] = true;
balances[msg.sender][_token] += _amount;
IERC20(_token).safeTransferFrom(msg.sender, address(this), _amount);
//written participant can not sign up others
//NewSignup emitted but no logic to sign up another person
emit NewSignup(msg.sender, _amount, getParticipationStatus(msg.sender));
}
}
```
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.