T09 · Insecure Skill Coding Practices
Error
- Location
onboard.ts:17- Finding
Value-Bearing Transactions Are Sent to a Placeholder Zero Address
- Content
View full analysis
0n) { console.log(`\n⚠️ You're already registered as Fren #${existingFrenId}`); console.log('Run "check-status" to see your Fren details.'); return; } } catch (e) { // Not registered yet, continue } ``` The script then submits a value-bearing transaction to that address: ```ts const hash = await walletClient.writeContract({ address: CONFIG.FREN_REGISTRY, abi: FREN_REGISTRY_ABI, functionName: 'registerFren', args: [options.name, options.bio, metadata], value: CONFIG.CREATION_FEE_ETH, }); ``` The treasury operation uses the same invalid destination: ```ts const hash = await walletClient.writeContract({ address: CONFIG.FREN_REGISTRY, abi: FREN_REGISTRY_ABI, functionName: 'claimTreasury', args: [amountWei] }); ``` ### Technical Analysis The onboarding implementation uses the Ethereum zero address as the registry destination even though the operation transfers a configured creation fee of `0.01 ETH`. A transaction to an address without contract bytecode does not execute the declared ABI function. A value-bearing transaction may nevertheless be accepted by the network and transfer the attach ...[truncated 2210 chars]- Remediation
View remediation