L-06.md

Zero token transfers in Distributor contract

Summary

The Distributor contract doesn't check for zero value token transfers, which may cause a revert for certain ERC-20 implementations.

Vulnerability Details

During the execution of the distribute() function, ERC20 tokens are transferred to winners and to the stadium address as part of the protocol's fee.

In both of these cases, there is no check if the resulting amount is greater than zero prior to executing the transfer. If any of these amounts gets rounded down to zero, the process may be blocked due to a revert in the ERC20 transfer call.

Impact

Low. The amount or percentage needs to be low enough so that it gets rounded to zero.

Tools Used

None.

Recommendations

Add to check to execute the transfer only when the amount is greater than zero.

    for (uint256 i; i < winnersLength;) {
        uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
+       if (amount > 0) {
            erc20.safeTransfer(winners[i], amount);
+       }
        unchecked {
            ++i;
        }
    }

    function _commissionTransfer(IERC20 token) internal {
-       token.safeTransfer(STADIUM_ADDRESS, token.balanceOf(address(this)));
+       uint256 balance = token.balanceOf(address(this));
+       if (balance > 0) {
+           token.safeTransfer(STADIUM_ADDRESS, balance);
+       }
    }