The _initStrategy
function uses a hardcoded router address in the contracts of StrategyMainnet.sol, StrategyOp.sol, and StrategyArb.sol. While the inclusion of setter functions provides some flexibility, several risks persist, including deployment challenges, testing difficulties, etc.
The hardcoded router address in the _initStrategy
function limits the contracts of StrategyMainnet.sol, StrategyOp.sol, and StrategyArb.sol to a specific deployment environment.
Instead, the address should be parameterized to allow for dynamic assignment.
If the hardcoded address is not yet deployed or functional during contract initialization, the safeApprove call may fail.
src/StrategyArb.sol_initStrategy:#L36
src/StrategyMainnet.sol:_initStrategy#L44
src/StrategyOp.sol:_initStrategy#L38
Atomicity Issues: Deployment errors in _initStrategy require a complete redeployment of the contract rather than a simple retry using a setter function.
Verification: Hardcoded addresses complicate code verification and require additional documentation to confirm their validity. Deployment across multiple environments (e.g., testnets) necessitates manual code changes, which can lead to inconsistencies.
Testing Limitations: Unit tests are hindered by fixed router addresses, making it difficult to simulate different scenarios and router behaviors. Integration tests require the exact address to exist on the test network, complicating the setup process.
Deployment and Upgrade Risks: Deployment failures caused by incorrect or unavailable addresses require redeployment, incurring additional gas costs. Setter functions cannot address issues arising during the initialization phase, necessitating redeployment.
Increased downtime or deployment retries due to initialization issues.
Potential financial loss from misconfigured or compromised router addresses.
Immutable hardcoded addresses remain vulnerable if exploited or deprecated.
Reduced test coverage and complexity in validating behaviors across environments.
Manual Review
Pass the router address as a parameter during contract deployment:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.