# NFTs can be transferred to zero address and fees can be claimed for these tokenids

ZeroLocker's transferFrom lacks a zero-address check, letting NFTs be sent to address(0), stranding assets and corrupting voting-power accounting.

- Payout: Contest reward
- Severity: medium
- Program: Zerolend
- Credited: Chinmay Farkya
- Disclosed: 2024-09-16
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_zerolend_jan2024.pdf#3.2.12
- Library page: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ZeroLocker / FeeDistributor NFT locking contracts
**Root cause:** _transferFrom never validates that _to != address(0) despite a comment claiming it does, so ownership and ownerToNFTokenIdList[address(0)] are updated without a burn checkpoint.
**Steps:**
1. Call `transferFrom(owner, address(0), tokenID)` on ZeroLocker; no revert occurs.
2. Observe ownerOf(tokenID) == address(0) and tokenID added to ownerToNFTokenIdList[address(0)].
3. Note no ending checkpoint is written, so bias/slope still count in global point history.
4. Call FeeDistributor claim for that tokenID; fees accrue to address(0) and anyone can trigger claim until lock expiry.
5. Underlying deposited assets remain stuck in ZeroLocker permanently.
**How found:** Read the _transferFrom comment claiming zero-address transfers are disallowed, then verified the code path performs no such check, tracing downstream effects on checkpoints, fee claims, and voting power.
**Exploitation:** Attacker transfers a locked NFT position to address(0), then repeatedly triggers fee claims (fees go to zero address) and uses the still-counted voting power via votingPowerOf/_balanceOfNFT since no zero-owner check exists, until lock expiry.
**Escalation:** Wrong total supply skews external voting/quorum calculations; stranded assets and orphaned voting power persist even after lock expiry.
**Insight:** When a comment asserts a safety check exists, grep the actual code path for it; missing zero-address guards in vote-escrow/locker contracts silently break burn accounting and leave claimable fees and orphaned voting power.