Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: high

IStratax defines calculateParams but implementation exposes calculateOpenParams (selector mismatch)

Author Revealed upon completion

Description

  • Normal behavior: interface helper methods for leverage calculation should map 1:1 to implementation and selectors.

  • Issue: Interface declares calculateParams(TradeDetails) while implementation exposes calculateOpenParams(TradeDetails). Selectors differ and ABI compatibility is broken.

// src/interfaces/internal/IStratax.sol
@> function calculateParams(TradeDetails memory details)
@> external
@> view
@> returns (uint256 flashLoanAmount, uint256 borrowAmount);
​
// src/Stratax.sol
@> function calculateOpenParams(TradeDetails memory details)
@> public
@> view
@> returns (uint256 flashLoanAmount, uint256 borrowAmount)

Risk

Likelihood:

  • Reason 1 // Integrators and SDKs frequently bind to interfaces rather than concrete implementation.

  • Reason 2 // Selector mismatch is deterministic and independent of runtime state.

Impact:

  • Impact 1 // Read-path tooling for position sizing can fail.

  • Impact 2 // Broken UX and automation pipelines due to ABI mismatch.

Proof of Concept

This PoC compares selectors derived from the interface declaration and the actual implementation function. The mismatch proves tooling bound to IStratax.calculateParams cannot call Stratax.calculateOpenParams without custom adaptation.

// test/poc/StrataxVulnerabilities.t.sol
function testPoC_InterfaceDrift_CalculateParamsSelectorFailsAgainstImplementation() public view {
bytes4 implSelector = bytes4(
keccak256("calculateOpenParams((address,address,uint256,uint256,uint256,uint256,uint256,uint256))")
);
bytes4 interfaceSelector = IStratax.calculateParams.selector;
assertTrue(implSelector != interfaceSelector, "selectors should differ");
}

Recommended Mitigation

Unify naming/signatures across interface and implementation, then enforce selector equality tests at build time. This prevents runtime surprises for SDKs, frontends, and bots that rely on typed ABI bindings.

- function calculateParams(TradeDetails memory details) external view returns (...);
+ function calculateOpenParams(TradeDetails memory details) external view returns (...);
​
+ // or rename implementation to calculateParams and keep one canonical name.
+ Add compile-time ABI drift tests for interface vs implementation.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!