Submission Details
Severity:
StrategyMainnet doesn't have a setRouter function so there isn't a way for a new router if there are issues with the Curve router
Summary
Both the StrategyArb.sol and StrategyOp.sol contracts have a setRouter function to potentially change swap routers if they turn out vulnerable/paused/not working correctly. StrategyMainnet.sol doesn't have such a function and it always relies on the Curve router working correctly.
StrategyArb.sol and StrategyOp.sol
function setRouter(address _router) external onlyManagement {
router = _router;
underlying.safeApprove(router, type(uint256).max);
}
Impact
Any potential issues with the Curve router will directly harm the operations of the protocol on mainnet and there won't be a way to set another DEX to swap.
Tools Used
Manual review
Recommendations
Consider adding a a setRouter function in StrategyMainnet to ensure that no outsiders issues will effect the contract.
Updates
Appeal created
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Cannot Set A New Router In `StrategyMainnet.sol`
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.