Submission Details
Severity:
Deployer Contract Uses Wrong USDC Address
[H-3] Deployer Contract Uses Wrong USDC Address
Description: The address in the deploy contract is wrong and does not point to ZKsync Era USDC contract.
Used Address = 0x1D17CbCf0D6d143135
be902365d2e5E2a16538d4Corr Address = 0x1d17CBcF0D6D143135
aE902365D2E5e2A16538D4
contract Deploy is Script {
@> address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
// 4 users, 25 USDC each
uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
.
.
.
}
Impact: If the protocol is deployed using this address, the resulting contract will always revert when trying to send the usdc to people calling the claim function.
Proof of Concept: Just search these addresses in ZKSync explorer:
Recommended Mitigation: Just Use the correct Address!
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
usdc-wrong-address
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.