Nouns DAO contest - IEatBabyCarrots's results

Lines of code

https://github.com/code-423n4/2022-08-nounsdao/blob/452695d4764ba9d5e1d3eef0d5ecca3d004f215a/contracts/base/ERC721Checkpointable.sol#L143

Vulnerability details

Impact

The delegate function contains a statement that sets the delegatee to msg.sender if the delegatee is the zero address if(delegatee == address(0)) delegatee = msg.sender; here yet the delegateBySig function does not. It doesn't seem to cause any loss of funds yet but it's clearly unintentional. Interactions with other contracts may break if they are assuming delegating to the zero address is not possible

Proof of Concept

Create an EIP-712 signature and pass in address(0) for the delegatee into function delegateBySig(address delegatee, uint256 nonce, uint256 expiry, uint8 v, bytes32 r, bytes32 s)

Tools Used

none

Recommended Mitigation Steps

Above this line add require(delegatee != address(0));