Part 2

Summary

The CurveAdapter contract calls the exchange_with_best_rate() method, however this method does not exist in the newer CurveRouterNG contract deployed on Arbitrum, causing all swap operations to revert and rendering the adapter non-functional.

Vulnerability Details

The issue exists in the CurveAdapter contract's swap execution logic. Specifically, the adapter attempts to call the non-existent exchange_with_best_rate() method.

The exchange_with_best_rate() method was part of Curve's outdated router, which is only deployed on Ethereum Mainnet. On Arbitrum (and other chains), the updated CurveRouterNG is deployed, which replaces this method with exchange(). This mismatch in method signatures and parameter structures will cause all calls to CurveAdapter.executeSwapExactInput() and CurveAdapter.executeSwapExactInputSingle() to revert on Arbitrum.

This issue is not observed during testing because the test suite uses a mock version of the Curve router (test/mocks/MockCurveStrategyRouter.sol).

Impact

All fee conversion operations via FeeDistributionBranch.convertAccumulatedFeesToWeth() that use Curve's pools will fail on Arbitrum. Disrupting core protocol functionality.

Tools Used

Manual Review.

Recommended Mitigation

Replace exchange_with_best_rate() with exchange() in the CurveAdapter contract. Align the parameters with the exchange() method's requirements. The new exchange() method requires different parameters, including a structured _route array and _swap_params parameters for pool routing, rather than the simplified _from/_to arguments from the old exchange_with_best_rate().

Example fixes: