Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Hardcoded address in `KeeperProxy` will not work on Avalanche

y4y

Summary

The protocol is to be deployed on Arbitrum and Avalanche, in KeeperProxy, sequencer address is hardcoded, however, such address only exists on Arbitrum, but not Avalanche.

Vulnerability Details

Here in KeeperProxy::initialize:

function initialize() external initializer {
__Ownable2Step_init();
// @audit hardcoded address will not work on avalanche
sequencerUptimeFeed = AggregatorV2V3Interface(
0xFdB631F5EE196F0ed6FAa767959853A9F217697D
);
}

We see the sequencer address is hardcoded, by check on Arbitrum, this is indeed a sequencer contract: https://arbiscan.io/address/0xFdB631F5EE196F0ed6FAa767959853A9F217697D

However, since the protocol will also be deploying as Avalanche, according to SnowScan on C-Chain: https://snowtrace.io/address/0xFdB631F5EE196F0ed6FAa767959853A9F217697D

This is an empty address. This means all function calls will fail, and since there is no other ways of updating sequencer address, it will cause permanent DOS.

Impact

Permanent DoS due to incorrect address on Avalanche chain.

Tools Used

Manual review

Recommendations

Change address accordingly or provide interface updating sequencer address.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_Avalanche_has_no_sequencer

Likelihood: High, run and runNextAction will revert. Impact: Low, any deposit will be retrieve thanks to cancelFlow.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.