The `transfer()` function in `precompiles/erc20/tx.go` doesn't validate that the recipient address is non-zero. Per ERC-20 standard (EIP-20), transfers to address(0) should revert, but currently they succeed, causing permanent token loss.