hardcoded address only on mainnet
Summary
The SCRVUSD address is hardcoded
Vulnerability Details
we can see SCRVUSD address is stored in constant variable in the contract.
and we can see
Compatibilities:
Blockchains:
- Any EVM, including solutions like neon on Solana
SCRVUSD address in only on eth mainnet
Impact
Breaking of core logic and every calls to address can be revert
Tools Used
Manual Review
Recommendations
add a set function so the address can be change when deploy on other EVM
Lead Judging Commences
[invalid] finding-hardcoded-srCRV-multi-chain
- Original scrvUSD exists only on mainnet – that's where it gets revenue. And these storage proofs are retrieved from Ethereum scrvUSD contract, meaning no other token deployment needed. - The point of using storage proofs is to port data from Ethereum to other networks. And storage proofs are just making it possible in a trustless manner wrt blockhash oracle.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.