20,000 USDC
View results
Submission Details
Severity: high
Valid

`ISwapRouter address` is hardcoded

Vulnerability Details

In Fees.sol, the ISwapRouter address is hardcoded, which is ok if deployed on "Mainnet, Goerli, Arbitrum, Optimism, Polygon" but not on Avalanche, BSC, Fantom etc according to Uniswap docs.

0xTingle said it could "also be deployed on other chains than Optimism".

Impact

The fees will be stuck in the Fees.sol contract since the swapRouter.exactInputSingle(params)function will fail.

Tools Used

Manual review

Recommendations

Don't hardcoded the ISwapRouter address and add a function to modify the ISwapRouter address if needed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!