Submission Details
Severity:
Incorrect USDC token address is being used in 'Deploy.s.sol'
Summary
The incorrect USDC token address is being used in the 'Deploy.s.sol' script.
Vulnerability Details
The Deploy script is using the wrong USDC token address as per zksync block explorer.
Address being used:
0x1D17CbCf0D6d143135be902365d2e5E2a16538d4
Correct USDC address:
0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4
Impact
If the contract is deployed with the wrong USDC token address being passed in, then the contract will not be able to airdrop the tokens.
Tools Used
--Foundry
Recommendations
It is recommended to change the contract address for the USDC token in the Deploy script to the correct one.
contract Deploy is Script {
- address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
+ address public s_zkSyncUSDC = 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4;
bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
// 4 users, 25 USDC each
uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
usdc-wrong-address
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.