Submission Details
Severity:
No functionality to update the router in `StrategyMainnet.sol`
Summary
The router address is hardcoded and initialized in constructor with StrategyMainnet::_initStrategy function. There is no way to update the router, but this functionality is intended by the developer, as it is implemented both in StrategyArb.sol and StrategyOp.sol with the setRouter function.
Impact
The management is unable to update the router address.
Tools Used
Manual review
Recommendations
Add the following function to StrategyMainnet.sol:
function setRouter(address _router) external onlyManagement {
router = ICurveRouterNG(_router);
underlying.safeApprove(address(router), type(uint256).max);
}
Be aware that safeApprove is deprecated. Consider using safeIncreaseAllowance as it was stated in the LightChaser's report.
Updates
Appeal created
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
Cannot Set A New Router In `StrategyMainnet.sol`
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366
OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.