search

code-423n4 / 2021-07-pooltogether-findings

0 stars 0 forks source link

Lack of zero address validation in _requireDifferentYieldSource() #17

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

JMukesh

Vulnerability details

Impact

Due to lack of zero address validation in _requireDifferentYieldSource(), it bypass the require condition when address(0) is entered

Proof of Concept

https://github.com/pooltogether/swappable-yield-source/blob/89cf66a3e3f8df24a082e1cd0a0e80d08953049c/contracts/SwappableYieldSource.sol#L247

Tools Used

manual review

Recommended Mitigation Steps

add condition to check zero address validation

PierrickGT commented 3 years ago

It was indeed a problem when we still had the transferFunds function but now that we can only call the swapYieldSource one to change of yield source and move funds, this function will be reverted with the error Transaction reverted: function call to a non-contract account when calling _newYieldSource.depositToken() if address zero is passed as param.

https://github.com/pooltogether/swappable-yield-source/blob/0fce3667e9c9c790b4348a7c286064268350cae6/contracts/SwappableYieldSource.sol#L251