Submission Details
Severity:
No Check for Zero Amount in buy
Summary
The buy function does not check if the amount is greater than zero.
Users could call the function with amount = 0, wasting gas and potentially causing unintended behavior.
Vulnerability Details
Function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
@> bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}
Impact
dos can happen.
Tools Used
Recommendations
Function buy(uint256 amount) external whenActive nonReentrant {
require(amount > 0, "Amount must be greater than 0");
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
// Existing logic
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.