Lack of zero address check in stakeFor() can lead to loss of funds

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/AuraBalRewardPool.sol#L138

Vulnerability details

Impact

In AuraBalRewardPool.sol, the stakeFor() function is lacking a crucial check against address(0). An incorrect input or wallet defaulting to the zero address will immediately cause loss of funds upon deposit.

A previous submission similar to this can be found here

Proof of Concept

If AuraBalRewardPool.stakeFor() is called with _for equal to address(0), the amount will be staked for the zero address, not any real user. This amount will not be able to be withdrawn.

Tools Used

Manual review

Recommended Mitigation Steps

Add a simple zero-address check on the stakeFor() function.

[0xMaharishi]

Any sort of dead address will have the same effect, not just address(0)

[0xahtle7]

similar to similar to #223

[dmvt]

The difference between this issue and #223 is that this function is callable by anyone. As a result the likelihood that a zero address check will prevent a pebkac user error or even a frontend code bug is much higher. Also, funds are at direct risk here given external factors. That makes it textbook medium risk.

[dmvt]

Per #364 (comment) I have decided to downgrade this to QA.

[dmvt]

Grouping this with the warden’s QA report, #246