Platform: Code4rena
Start Date: 25/11/2021
Pot Size: $80,000 USDC
Total HM: 35
Participants: 32
Period: 7 days
Judge: GalloDaSballo
Total Solo HM: 27
Id: 59
League: ETH
Rank: 26/32
Findings: 1
Award: $264.90
🌟 Selected for report: 1
🚀 Solo Findings: 0
99.3381 USDC - $99.34
BouSalman
On contract Permissions.sol there is multiple functions to withdraws funds, these functions currently do not check for zero value address before doing the transaction.
Loss of funds, ETHs and ERC20.
https://github.com/code-423n4/2021-11-malt/blob/c3a204a2c0f7c653c6c2dda9f4563fd1dc1cecf3/src/contracts/Permissions.sol#L80 https://github.com/code-423n4/2021-11-malt/blob/c3a204a2c0f7c653c6c2dda9f4563fd1dc1cecf3/src/contracts/Permissions.sol#L88 https://github.com/code-423n4/2021-11-malt/blob/c3a204a2c0f7c653c6c2dda9f4563fd1dc1cecf3/src/contracts/Permissions.sol#L97 https://github.com/code-423n4/2021-11-malt/blob/c3a204a2c0f7c653c6c2dda9f4563fd1dc1cecf3/src/contracts/Permissions.sol#L104
manual code review.
use require() statement to validate address address(0) before sending the funds.
#0 - GalloDaSballo
2022-01-09T22:57:36Z
Agree with the finding, lack of input checks is Low Severity, will raise to that
🌟 Selected for report: Meta0xNull
Also found by: BouSalman
BouSalman
On contract Permissions, the function reassignGlobalAdmin is used to assign global admin However No checking is done on the _admin parameter.
locking.
manual code review.
use require() statement to check for address(0).
#0 - 0xScotch
2021-12-10T17:33:15Z
#113
#1 - GalloDaSballo
2022-01-25T00:49:36Z
Duplicate of #113