Submission Details
Impact:
Likelihood:
Zero Address Transfer Bug — Tokens Burned Silently
Root + Impact
Missing checks for to_address == 0x0 leads to silent token burn.
Description
Transfers to zero address do not revert — they silently reduce balances, effectively burning tokens.
// @> transfer.rs
pub fn transfer(from: Addr, to: Addr, amount: Uint128) -> Result<()> {
...
// Missing check for zero address recipient — this burns tokens
balances[to] += amount; // @>
...
}
Risk
Likelihood:
-
Any user can mistakenly or maliciously send to 0x0 any time
-
UX flows may incorrectly populate zero address under failure cases
Impact:
-
Permanent token loss — user funds are unrecoverable
-
Market disruption if large amount is burned
Proof of Concept
Token is subtracted from Alice, never credited.
transfer(
from = alice,
to = "0x0000000000000000000000000000000000000000",
amount = 100_000
)
Recommended Mitigation
Explicitly reject zero address:
ensure!(to != Addr::zero(), Error::InvalidAddress);
Add tests to enforce this rule.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.