Skip to content

Latest commit

 

History

History
47 lines (24 loc) · 1.36 KB

044.md

File metadata and controls

47 lines (24 loc) · 1.36 KB

Odd Tartan Gerbil

Medium

Hardcoded Address for vaultOldAddress

Summary

The hardcoded address for vaultOldAddress will cause deployment issues for the contract users as they will not be able to deploy in different environments where the address differs.

Root Cause

In vaultV2Deployer.sol:45, the address vaultOldAddress is hardcoded instead of being passed as a parameter.

Internal pre-conditions

  1. Admin needs to deploy the contract with a fixed address for vaultOldAddress.

External pre-conditions

  1. No external conditions required for this issue to manifest.

Attack Path

  1. The contract is deployed with a hardcoded vaultOldAddress.
  2. The contract cannot interact with the correct address if deployed in a different environment or address changes.

Impact

The affected party (contract users) cannot deploy the contract correctly in different environments due to the hardcoded address.

PoC

Numa/contracts/deployment/vaultV2Deployer.sol 

address vaultOldAddress = 0x8Fe15Da7485830f26c37Da8b3c233773EB0623D2; // Hardcoded address

Mitigation

Replace the hardcoded address with a constructor parameter to allow dynamic address assignment during deployment.