SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Logical Denial of Service for Self-Recipients

n0d3_

Root + Impact

Description

Normally, a user performing an action on-chain expects to be able to receive the resulting proceeds in their own wallet.

The contract explicitly reverts if the recipient address is equal to the msg.sender. This creates an unnecessary hurdle for users and provides no additional security, as a user can simply generate a proof for a secondary burner wallet.

// Root cause in the codebase
@> if (recipient == address(0) || recipient == address(this) || recipient == owner || recipient == msg.sender) revert InvalidRecipient();

Risk

Likelihood: High

  • Standard user behavior is to use one wallet; this check will trigger for almost all initial attempts by users.

Impact: Low

  • The contract prevents the msg.sender from being the recipient of the reward. This forces users to manage multiple addresses and complicates the ZK-proof generation process, as the recipient address is typically a public input bound to the proof.

Proof of Concept

​

Recommended Mitigation

Allow the msg.sender to be the recipient of the funds.

- if (recipient == address(0) || recipient == address(this) || recipient == owner || recipient == msg.sender) revert InvalidRecipient();
+ if (recipient == address(0) || recipient == address(this) || recipient == owner) revert InvalidRecipient();
Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

incorrect self-transfer rejection

The issue is that `claim()` rejects any case where `recipient == msg.sender`, even though the proof system already binds the claim to the recipient address and the contract ultimately transfers the reward to that same recipient, so prohibiting self-receipt does not protect any obvious security property of the payout flow. It is a low-severity logic or UX restriction, which unnecessarily forces honest claimants to control and provide a second wallet address in order to receive funds.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!