Submission Details
Severity:
Using function of outdated CurveRegistryExchange contract
Summary
The CurveAdapter contract uses the exchange_with_best_rate call to the router for Curve liquidity pools. But according to the Curve Technical Docs () the CurveRegistryExchange contract, which implements the function, is outdated and a new and updated version of router should be used instead. Moreover, only the new router is deployed on the Arbitrum chain .
Vulnerability Details
function executeSwapExactInputSingle(SwapExactInputSinglePayload calldata swapPayload)
<...>
>> return ICurveSwapRouter(curveStrategyRouterCache).exchange_with_best_rate({
_from: swapPayload.tokenIn,
_to: swapPayload.tokenOut,
_amount: swapPayload.amountIn,
_expected: amountOutMinimum,
_receiver: swapPayload.recipient
});
Impact
Tools used
Manual Review
Recommendations
Consider implementing integration with the CurveRouterNG contract: .
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Protocol uses CurveRegistryExchange which is outdated
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.