Penalty value lost if penaltyForwarder is address(0)

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraMerkleDrop.sol#L151-L152

Vulnerability details

Impact

Penalty details are lost if the penaltyForwarder address is address(0)

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/AuraMerkleDrop.sol#L151-L152

Here the check for address(0) is used after the penalty is set to zero. If the require statement fails in this function, the accumulated penalty still remains set to zero.

Tools Used

Manual checks

Recommended Mitigation Steps

Add the address(0) check before setting the penalty as zero

require(penaltyForwarder != address(0), "!forwarder");
aura.safeTransfer(penaltyForwarder, toForward);
pendingPenalty = 0;

[0xMaharishi]

technically true but arguable invalid.. this won't be set in the constructor to be 0

[dmvt]

I'm leaving this one in place as a gas issue. There is no way to update penaltyForwarder meaning this mistake would be irreversible and require a redeployment. Beyond that there is no impact.