OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

[Medium] Missing validation for zero token address in "emergencyWithdrawERC20"

ggjhtu887

Root + Impact

  • Griefing vector if owner automation scripts call this function blindly

  • Violates common ERC20 assumptions

  • Reverts unintentionally

Description

The function does not validate that _tokenAddress is non-zero. If a caller passes address(0), the function will attempt to interact with a non-existent token contract and revert. This leads to unexpected behavior and can break off-chain integrations or automation.

function emergencyWithdrawERC20(address _tokenAddress, uint256 _amount, address _to) external onlyOwner {
if (
_tokenAddress == address(iWETH) || _tokenAddress == address(iWBTC) || _tokenAddress == address(iWSOL)
|| _tokenAddress == address(iUSDC)
) {
revert("Cannot withdraw core order book tokens via emergency function");
}
if (_to == address(0)) {
revert InvalidAddress();
}
IERC20 token = IERC20(_tokenAddress);
token.safeTransfer(_to, _amount);
​
emit EmergencyWithdrawal(_tokenAddress, _amount, _to);
}

Risk

Likelihood:

  • Reason 1 Anyone can brick the function by passing address(0)

  • Reason 2 Creates unnecessary fragility

Impact:

  • Impact 1 Anyone can brick the function by passing address(0)

  • Impact 2 Creates unnecessary fragility

Proof of Concept

The emergencyWithdrawERC20 function lacks a check to ensure _tokenAddress is not the zero address.
While the function blocks core tokens like iWETH, iWBTC, iWSOL, and iUSDC, it does not reject address(0), which is not a valid ERC20 token.

Calling IERC20(address(0)).safeTransfer(...) results in a low-level call to a non-contract, which reverts.

This makes the function fragile, and the contract may unexpectedly revert if _tokenAddress is ever 0x0.

//Add this in test/TestOrderBook
​
function testEmergencyWithdrawWithZeroAddress() public {
address owner = address(this);
​
vm.expectRevert();
orderBook.emergencyWithdrawERC20(address(0), 1 ether, owner);
}

Recommended Mitigation

Add a zero-address validation at the top of the function

if (_tokenAddress == address(0)) revert InvalidToken();
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge
4 months ago
yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

ggjhtu887 Submitter
4 months ago
yeahchibyke Lead Judge
4 months ago
yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.