Skip to content

Missing Zero-Value Validation on Value-Moving Function

SAFE-0304 Input Validation Checked automatically by the scanner
1

What goes wrong

A deposit/withdraw/transfer/mint function does not reject a zero amount. Zero-value calls waste gas, can emit misleading events, and in accounting systems can trigger divide-by-zero or share-price edge cases.

2

The vulnerable pattern

proof of concept — how it is exploited
// deposit(0) emits Deposit(user, 0) and, in a vault, shares = 0*supply/assets
// -> 0 shares minted but an event/log implies a real deposit; also a
// division that assumes amount>0 can revert or misbehave.
3

How to fix it

the pattern that is safe
require(amount > 0, "zero amount");
Validate amount > 0 on value-moving entrypoints.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0304 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs