Foundation contest - kirk-baird's results

Lines of code

https://github.com/code-423n4/2022-02-foundation/blob/main/contracts/FETH.sol#L232-L242

Vulnerability details

Impact

The function depositFor(address account) allows account to be zero. If a user / program accidentally sets this value to be zero then the msg.value will be added to accountToInfo[address(0)] and the funds will not be recoverable.

Proof of Concept

  function depositFor(address account) public payable {
    if (msg.value == 0) {
      revert FETH_Must_Deposit_Non_Zero_Amount();
    }
    AccountInfo storage accountInfo = accountToInfo[account];
    // ETH value cannot realistically overflow 96 bits.
    unchecked {
      accountInfo.freedBalance += uint96(msg.value);
    }
    emit Transfer(address(0), account, msg.value);
  }

Recommended Mitigation Steps

Consider adding a check to ensure account is non zero to prevent accidental loss of funds.

For example

  function depositFor(address account) public payable {
    if (account == address(0)) {
      revert FETH_Must_Deposit_Non_Zero_Account();
    }
    ...