Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Chainlink Uptime Registry address should be made configurable in storage to avoid redployments

ashishlach

Summary

intialize() function under KeeperProxy.sol uses hardcoded contract address of upkeep but it is not recommended as per chainlink documentation. Please refer the same as It applies for all up keep contract addresses

function initialize() external initializer {
__Ownable2Step_init();
sequencerUptimeFeed = AggregatorV2V3Interface(
0xFdB631F5EE196F0ed6FAa767959853A9F217697D
);
}

Vulnerability Details

Here is the code:

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/KeeperProxy.sol#L48

Impact

Main calls to the protocol, like runAction(), runNextAction() will always fail if chainlink upgrades the address of its upkeep contract. Since this protocol lacks upgradability, it risks halting all operations dependent on Chainlink price feeds when an update becomes necessary.

Tools Used

Manual Review

Recommendations

  1. Mandatory: Must make the address configurable

  2. Optional: Make the contracts upgradable to mitigate any issues discovered in future

  3. Optional: Have a backup Oracle as last option like - TWAP

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.