Token-0x
First Flight #54
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Missing Zero Value Check in `_burn` function, gas loss and spam.

Author Revealed upon completion

Root + Impact

Description

The _burn function does not check if value is zero before performing operations.

  • Wastes gas on unnecessary storage operations

  • Emits events for no-op operations (once events are added)

  • Could be used for griefing/spam attacks

// Root cause in the codebase with @> marks to highlight the relevant section
function _burn(address account, uint256 value) internal {
assembly ("memory-safe") {
if iszero(account) {
mstore(0x00, shl(224, 0x96c6fd1e))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
@>
let ptr := mload(0x40)
let balanceSlot := _balances.slot
let supplySlot := _totalSupply.slot
​
let supply := sload(supplySlot)
sstore(supplySlot, sub(supply, value))
​
mstore(ptr, account)
mstore(add(ptr, 0x20), balanceSlot)
​
let accountBalanceSlot := keccak256(ptr, 0x40)
let accountBalance := sload(accountBalanceSlot)
sstore(accountBalanceSlot, sub(accountBalance, value))
}
}

Risk

Likelihood:

  • Even though the likelihood is low, the absence of this check could negatively affect the protocol and its front-end implementations.

Impact:

  • Unnecessary gas consumption

  • Potential spam vector

  • Inconsistent with best practices

Proof of Concept

This test verifyes that there is no revertn on zero value burn in the _burn functions.

function test_burnZeroAmount() public {
uint256 amount = 100e18;
address account = makeAddr("account");
token.mint(account, amount);
token.burn(account, 0);
}

Recommended Mitigation

Add zero value check to the _burn functions.

function _burn(address account, uint256 value) internal {
assembly ("memory-safe") {
if iszero(account) {
mstore(0x00, shl(224, 0x96c6fd1e))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
​
+ if iszero(value) {
+ revert(0, 0) // Or return early
+ }
​
.
.
.
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!