Submission Details
Severity:
Public state variables in NFTLiquidator.sol
Summary
The NFTLiquidator contract contains contract dependencies (crvUSD, nftContract, stabilityPool, and indexToken) that are not immutable. This introduces a severe risk where an attacker can modify these addresses.
Vulnerability Details
Mutable Critical Contract Addresses, the contract allows the modification of important variables post-deployment:
IERC20 public crvUSD;
IERC721 public nftContract;
address public stabilityPool;
IndexToken public indexToken;
Impact
Potential fund theft, manipulation, or contract exploitation.
Tools Used
Manual review
Recommendations
Change these variables from public to immutable.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.