Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Hardcoded AugustusSwapper Address in ParaSwapUtils:: Causing swap to fail on Avalanche

josh4324

Summary

The _validateCallData function is designed to validate that an external call is made to the correct Paraswap AugustusSwapper contract. However, the function hardcodes the AugustusSwapper address for Arbitrum, making this feature unusable when the contract is deployed on other chains like Avalanche, where AugustusSwapper has a different address.

Vulnerability Details

function swap(address to, bytes memory callData) external {
_validateCallData(to, callData);
address approvalAddress = IAugustusSwapper(to).getTokenTransferProxy();
address fromToken;
uint256 fromAmount;
assembly {
fromToken := mload(add(callData, 68))
fromAmount := mload(add(callData, 100))
}
IERC20(fromToken).safeApprove(approvalAddress, fromAmount);
(bool success, ) = to.call(callData);
require(success, "paraswap call reverted");
}
​
function _validateCallData(address to, bytes memory callData) internal view {
@> require(to == address(0xDEF171Fe48CF0115B1d80b88dc8eAB59176FEe57), "invalid paraswap callee");
address receiver;
assembly {
receiver := mload(add(callData, 196))
}
require(receiver == address(this), "invalid paraswap calldata");
}

This is the AugustusSwapper address on Arbitrum. However, on Avalanche, AugustusSwapper has a different address. When deployed on Avalanche, all swap transactions will fail due to the mismatch in contract address.

The contract is intended to be deployed on both Arbitrum and Avalanche, but this hardcoded address prevents it from working on avalanche.

Impact

Any transaction using _validateCallData on Avalanche will revert, making the contract unusable on that chain.

If Paraswap updates the AugustusSwapper address on Arbitrum, the contract will become obsolete and require redeployment.

Tools Used

Manual Review

Recommendations

Instead of hardcoding, store the AugustusSwapper address in contract storage and have setter and getter functions.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!