search

code-423n4 / 2022-01-sandclock-findings

0 stars 0 forks source link

Check _to is not empty #183

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

functions claimYield, _withdraw, and _unsponsor should validate that _to is not an empty 0x0 address to prevent accidental burns.

Recommended Mitigation Steps

Consider implementing the proposed validation: require _to != address(0)

dmvt commented 2 years ago

In this case assets are at risk due to external factors. A zero address check makes sense.

naps62 commented 2 years ago

Fixed in https://github.com/sandclock-org/solidity-contracts/pull/85