search

code-423n4 / 2023-07-arcade-findings

2 stars 1 forks source link

User can delegate to address(0) in ARCDVestingVault thereby increasing address(0) VotingPower #557

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/main/contracts/ARCDVestingVault.sol#L260

Vulnerability details

Impact

There is no zero address check in the delegate() function in ARCDVestingVault contract. This allows address(0) to be able to accumulate VotingPower.

Proof of Concept

  1. In ARCDVestingVault.delegate(), Alice calls the function with voting Power 100e18 and address(0) as the to address.
  2. This would delegate Alice's voting power to address(0).
  3. Bob calls ARCDVestingVault.delegate() with voting power 100e18.
  4. New Voting Power of address(0) is 200e18

Tools Used

Manual review

Recommended Mitigation Steps

Add a Non Zero address check to ensure users do not delegate to address(0).

Assessed type

Other

c4-pre-sort commented 1 year ago

141345 marked the issue as primary issue

141345 commented 1 year ago

User's own input/mistake.

Also no loss, can delegate back

c4-pre-sort commented 1 year ago

141345 marked the issue as low quality report

c4-judge commented 1 year ago

0xean marked the issue as unsatisfactory: Invalid