Submitted by berndartmueller, also found by 0x1f8b and blackscale
In the RubiconMarket contract, the feeTo storage variable stores the recipient of taker trade fees (i.e. buy function). feeTo can be set to any arbitrary address in setFeeTo(address newFeeTo). As there is no zero-address validation, the owner can set a zero-address as the feeTo address.
All subsequent buy function calls with a _offer.buy_gem ERC20 token reverting on zero-address transfers (e.g. USDC), will revert.
RubiconMarket.sol#L297-L300
Check if feeTo is set to a non-zero address before transferring fees.
bghughes (Rubicon) disputed and commented:
HickupHH3 (judge) commented:
