# Codeless or zero address credited

Transfers or registries that accept address(0) or codeless addresses and still credit balances

_Area: DeFi accounting and math bugs. Seen in 17 disclosed reports; one confirmed bounty: $100,000; latest 2026-03-13. Updated 2026-10-22._

## How it works
Accounting code assumes that a transfer to an address means value moved to a real holder, and that address(0) is a harmless sentinel. Both assumptions break. Transfer helpers that skip code-existence checks return success for codeless addresses, so the protocol credits a balance that no token backs [E2](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.1.1.md)[E4](https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AH-03.md). Sentinel handling diverges: a getter maps address(0) to "self" while the setter writes address(0) literally, so balance moves to a dead address [E5](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-06.md). Guards written as `to != address(0)` skip invariant checks on burn paths, and `from != address(0)` skips them on mint paths [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-apwine-incorrect-check-of-delegations-bugfix-review.md). Unset struct fields default to address(0) and are used as recipients [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-09.md).

## Where to show up
- Transfer libraries (SafeTransferLib, solmate) used with user-supplied token addresses; no `extcodesize`/code check before crediting [E2](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.1.1.md)[E4](https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AH-03.md)
- ERC20 hooks (`beforeTokenTransfer`) with require statements gated on `to != address(0)` or `from != address(0)` [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-apwine-incorrect-check-of-delegations-bugfix-review.md)
- Getters that map a stored zero to a default while setters write zero directly [E5](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-06.md)
- Structs with a `receiver`/`to` field left unset and consumed by internal swap/transfer logic [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-09.md)
- Field-by-field validation of user-supplied parameter structs where one field later becomes a source of truth [E3](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md)
- Cross-chain or rescue paths that skip existence validation and record attacker-influenced state in try/catch [E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md)
- Refund helpers that require the recipient to be a contract [E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AM-02.md)

## How to review
For every path that credits a balance, trace the address and token to their source and confirm: (1) the token address has deployed code before any credit; (2) address(0) is rejected or handled identically in getter and setter; (3) invariant checks are not inside `to != address(0)`/`from != address(0)` guards, so burn and mint paths still enforce them; (4) every field of a user-supplied struct is validated, especially fields later read as repayment asset or recipient; (5) internal transfer logic consumes the same recipient the caller intended, not an unset struct field. The invariant: a credited balance must correspond to tokens actually held by the protocol, and no value may be routed to an address that cannot receive it.

## Variants seen
- Burn path bypasses delegation check via `to == address(0)` guard [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-apwine-incorrect-check-of-delegations-bugfix-review.md)
- Codeless token address accepted, phantom balance inflated [E2](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.1.1.md)[E4](https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AH-03.md)
- Unvalidated struct field used as repayment asset [E3](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md)
- Getter/setter asymmetry on address(0) delegation [E5](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-06.md)
- Refund to EOA reverts because helper requires code [E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AM-02.md)
- Unset `receiver` field defaults to address(0), burning funds [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-09.md)
- Nonexistent ID accepted cross-chain, rescue records attacker asset [E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md)

## Impact and severity
Yield theft [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-apwine-incorrect-check-of-delegations-bugfix-review.md), drain of victim deposits [E2](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.1.1.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md), permanent fund lock [E5](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-06.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AM-02.md), total loss via burn [E7](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-09.md), inflated refunds [E8](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md). Severity is high because losses are direct and often irreversible; worse when the bad address is attacker-chosen or when deterministic deployment addresses make codeless tokens later real [E4](https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AH-03.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-apwine-incorrect-check-of-delegations-bugfix-review.md
- E2: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AH-03.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-06.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AM-02.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-09.md
- E8: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md