Submission Details
Severity:
Missing Zero Address Check for Recipient in `LendingPool::rescueToken` Function
Summary
The rescueToken function in the LendingPool contract lacks a zero address validation for the recipient parameter, which could lead to permanent loss of tokens if the owner accidentally provides address(0) as the recipient.
Vulnerability Details
function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyOwner {
require(tokenAddress != reserve.reserveRTokenAddress, "Cannot rescue RToken");
IERC20(tokenAddress).safeTransfer(recipient, amount); <==@found
}
Impact
Tokens could be permanently lost if transferred to address(0)
Tools Used
Manual Review
Recommendations
Add a zero address check for the recipient parameter.
function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyOwner {
require(tokenAddress != reserve.reserveRTokenAddress, "Cannot rescue RToken");
+ require(recipient != address(0), "Invalid recipient address");
IERC20(tokenAddress).safeTransfer(recipient, amount);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.