Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

M-2 No Checks for Zero Address Transfers in afterOrderExecution()

radcipher

Summary

In the function afterOrderExecution, safeTransfer() is used to transfer tokens, but there are no checks to ensure that the recipient address is valid - not the zero address.

if (eventData.uintItems.items[0].value > 0) {
// @audit check for address(0)?
IERC20(eventData.addressItems.items[0].value).safeTransfer(perpVault, eventData.uintItems.items[0].value);
}
// @audit check for address(0)?
if (eventData.uintItems.items[1].value > 0) {
IERC20(eventData.addressItems.items[1].value).safeTransfer(perpVault, eventData.uintItems.items[1].value);
}

Vulnerability Details

  • eventData.addressItems.items[0].value and eventData.addressItems.items[1].value are used as token addresses.

  • If either of these values is address(0), the contract could attempt to transfer tokens to a null address, potentially locking funds.

Impact

  • Loss of Funds – If safeTransfer is called with address(0), the funds are effectively burned, as no one can access them.

  • Potential Contract Reverts – Some ERC-20 implementations may revert when trying to transfer to address(0), which could halt execution.

Tools Used

  • Manual review

Recommendations

  • Validate token addresses before calling safeTransfer, check if the token address is valid. Example:

require(eventData.addressItems.items[0].value != address(0)
require(eventData.addressItems.items[1].value != address(0)
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.