First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-0] USDC address in `Deploy.s.sol` is pointing to a wrong address

bijan

Summary

The USDC address hardcoded in the Deploy.s.sol::s_zkSyncUSDC script variable is wrong, which is an immutable constructor input for MerkleAirdrop contract and it will render the deployed airdrop contract useless.

Vulnerability Details

The USDC address of zkSync era mainnet that will be used for deployment in the Deploy.s.sol script is wrong and the correct address is 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4 which you can find in the official resources here.

Impact

This will cause any attempt to interacting with the USDC contract fail since it's pointing to a wrong address.

Additionally, a bad actor could know this beforehand and by using the deterministic features of blockchain (create2 method), deploys a malicious contract at the specified address.

Tools Used

Manual review, zkSync era block explorer

Recommendations

Simply replace the wrong address in Deploy.s.sol with the correct one:

- address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
+ address public s_zkSyncUSDC = 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4;
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usdc-wrong-address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.