DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: low
Valid

`PIPELINE` address is hardcoded in DepotFacet.sol

Summary

Address PIPELINE is hardcoded to 0xb1bE0000C6B3C62749b5F0c92480146452D15423 and used in all the interactions inside DepotFacet.sol

However, it may not be possible to deploy a PIPELINE to the same address on L2 due to several factors:

  1. Private key of original PIPELINE deployer is lost

  2. ZkSync uses different formula for address derivation https://docs.zksync.io/build/developer-reference/ethereum-differences/evm-instructions#address-derivation. So on ZkSync it can't be deployed to the same hardcode address.

Impact

DepotFacet is unusable after migration.

Tools Used

Manual Review

Recommendations

Configure PIPELINE during deployment in storage.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Hardcoded Pipeline address

Appeal created

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Hardcoded Pipeline address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.