Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

createHATPaymentSplitter function doesn't check for duplicate addresses, zero addresses, and length of both parameter arrays #56

Open
hats-bug-reporter bot opened this issue Nov 4, 2023 · 1 comment
Labels
bug Something isn't working invalid This doesn't seem right

Comments

@hats-bug-reporter
Copy link

Github username: @ololade97
Submission hash (on-chain): 0x433ac82f0d8f9656352c9cb52c78a6a65b3471c1c2900beae649de71d66fec0a
Severity: high

Description:
Description
According to the Openzeppelin documentation, when implementing a PaymentSplitter, all addresses in payees must be non-zero. Both arrays must have the same non-zero length, and there must be no duplicates in payees.

See here:
https://docs.openzeppelin.com/contracts/2.x/api/payment

In the createHATPaymentSplitter function, the above are not checked.

Attachments
https://github.com/hats-finance/hats-contracts/blob/0d6ebbde912bc272d9b310140d434ee2aacd36d3/contracts/HATPaymentSplitterFactory.sol#L17-L22

  1. Proof of Concept (PoC) File

https://docs.openzeppelin.com/contracts/2.x/api/payment

  1. Revised Code File (Optional)
@hats-bug-reporter hats-bug-reporter bot added the bug Something isn't working label Nov 4, 2023
@jellegerbrandy jellegerbrandy added the invalid This doesn't seem right label Nov 5, 2023
@jellegerbrandy
Copy link

These checks are implemented in the OZ code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

1 participant