Kinetic Disclosed Report

https://github.com/kinetic-market/public-money-market-contracts

Summary

The depositEther function allows the owner to allocate Ether to user addresses without verifying that those addresses are non-zero. This flaw authorizes allocations to address(0), effectively burning Ether and making it irretrievable.

Finding Description

The contract’s depositEther loop assigns Ether amounts to any user address from the input arrays. Because there is no check for user != address(0), allocations to the zero address remain possible. This practice breaks the principle that only valid addresses should receive Ether. Any allocation to address(0)—be it accidental or maliciously inserted—results in permanent loss of funds, as the zero address cannot transfer Ether out. This jeopardizes the contract’s assumption that allocated Ether remains claimable by intended recipients.

Allocations to the zero address irreversibly destroy funds, causing financial discrepancies and trust issues.

Impact Explanation

Impact: Medium. The zero address allocation leads directly to burned funds, reducing available Ether and undermining the protocol’s integrity. While it does not enable theft, it creates permanent financial loss for the system or its users.

Likelihood: Low to moderate, depending on how carefully the owner or scripts manage recipient addresses. A single configuration slip or malicious set of inputs easily triggers this event.

Recommendation

Enforce a zero address check before assigning Ether:

for (uint i; i < userCount; ) {
    address user = users[i];
    uint256 amount = amounts[i];
    require(user != address(0), "Invalid user address");
    ...
}

Proof of Concept

1. Owner Calls depositEther with a users array containing address(0) and a valid amount.
2. Funds Burned:
3. The contract updates userPendingEther[address(0)] += amount. Because address(0) is not a legitimate recipient, any subsequent claim to address(0) is impossible.
4. Permanent Loss: The Ether is locked with no route for recovery, diminishing the overall funds allocated to real users.