Submission Details
Severity:
Wrong hardcoded USDC address
Summary
In Deploy.s.sol the hardcoded USDC addres, stored in the s_zkSyncUSDC variable has a typo in it. The
Impact
High, as the run function will create a MerkleAirdrop with a wrong IERC20 token. Afterwards in the same function, real USDC will be sent, which will be forever locked in the MerkleAirdrop, since MerkleAirdrop won't be capable of sending it back in any way.
Tools Used
Manual Review
Recommendations
Two actions would make the script working properly and behave better:
Paste the correct USDC address in the
s_zkSyncUSDCvariableUse
s_zkSyncUSDCin the transfer of USDC down the function.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
usdc-wrong-address
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.