Submission Details
Severity:
Magicnumber in `Deploy` contract causes typo in address locking the funds
Summary
In Deploy.s.sol, there is a hardcoded address 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4 that should match the s_zkSyncUSDC variable. However, a typo in one of the addresses led to the USDC being sent to the contract with the wrong address provided to the contract constructor.
Impact
This error results in the funds being locked in the contract indefinitely.
Tools Used
Manual review
Recommendations
In Deploy, use the variable s_zkSyncUSDC instead of a magic number for the address:
- IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
+ IERC20(s_zkSyncUSDC).transfer(address(airdrop), s_amountToAirdrop);
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
usdc-wrong-address
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.