Submission Details
Impact:
Likelihood:
Missing zero address validation
Root + Impact
The FestivalPass contract should verify input of address type are not zero. This will lead to loss of funds and unexpected behaviour.
Recommended Mitigation
constructor(address _beatToken, address _organizer) ERC1155("ipfs://beatdrop/{id}") Ownable(msg.sender){
+ require(_beatToken != address(0), "Beat token address cannot be 0");
setOrganizer(_organizer);
beatToken = _beatToken;
}
function setOrganizer(address _organizer) public onlyOwner {
+ require(_organizer != address(0), "Organizer cannot be the zero address");
organizer = _organizer;
// missing event for this state change
}
function withdraw(address target) external onlyOwner {
+ require(target != address(0), "Target cannot be the zero address");
payable(target).transfer(address(this).balance);
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Zero address check
Owner/admin is trusted / Zero address check - Informational
Rewards breakdown
nSLOC
234This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.