# Zero address accepted as recipient

Transfer, offer, or payout path accepting address(0) as recipient, stranding value

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-24._

## How it works
A value-moving path (token transfer, order placement, payout, burn) treats `address(0)` as an ordinary recipient. The assumption that "any address is a valid destination" breaks: value is assigned to an address nobody controls, or a guard that should reject zero is missing. In ERC721-style code the same gap lets `from == address(0)` pass as a valid source, so a burnt token with stale approval can be revived [E1](https://bugbountylibrary.com/r/c4%3A2022-09-artgobblers%3AH-01.md).

## Where it shows up
- `transferFrom`/`_transfer`/`_transferFrom` with no `to != address(0)` check, especially where a comment claims one exists [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12.md).
- Burn loops that delete ownership but leave per-token approvals intact [E1](https://bugbountylibrary.com/r/c4%3A2022-09-artgobblers%3AH-01.md).
- Order/offer entry points (`offer()`, listing, bid) that store `owner`/`recipient` without sanitizing zero [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-12.md).
- Fill loops (`buyAllAmount`, `sellAllAmount`) that iterate a sorted best-offer list and revert on the first unfillable entry [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-12.md).
- Vote-escrow/locker contracts updating `ownerToNFTokenIdList[address(0)]` and checkpoints without a burn path [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12.md).

## How to review
Check the invariant: **no state-changing path may assign ownership, claim rights, or payable value to `address(0)`, and no transfer may accept `from == address(0)` unless it is a mint.** For each transfer/offer/payout function, confirm an explicit zero-address guard on both source and destination. For burns, confirm approvals are cleared alongside ownership. For fill loops, confirm a single reverting entry cannot block the whole iteration. When a comment asserts a check, grep the actual code path for it [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12.md).

## Variants seen
- Stale approval plus missing `from == address(0)` guard revives burnt tokens for free minting [E1](https://bugbountylibrary.com/r/c4%3A2022-09-artgobblers%3AH-01.md).
- Zero-recipient offer at best price makes fills revert, DoSing market and downstream position logic [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-12.md).
- Locker NFT sent to zero strands assets and corrupts voting-power/fee accounting [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12.md).

## Impact and severity
Led to free minting of valuable tokens [E1](https://bugbountylibrary.com/r/c4%3A2022-09-artgobblers%3AH-01.md), full denial of service on market operations [E2](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-12.md), and stranded assets plus broken accounting [E3](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12.md). Severity rises when the zero-address entry sits at the head of a shared sorted list or feeds governance/voting power, amplifying a single bad entry into protocol-wide failure.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-09-artgobblers%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-12.md
- E3: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.12.md