Stratax Contracts

First Flight #57
Beginner FriendlyDeFi
100 EXP
Submission Details
Impact: low
Likelihood: high

`USDC` state variable declared and initialized but never used in protocol logic

Author Revealed upon completion

Root Cause + Impact

address public USDC (L106) is set during initialize() (L183) but never referenced in any protocol logic. It occupies a storage slot in every proxy, adds a deployment parameter that serves no purpose, and misleads integrators into thinking USDC has special handling in the protocol.

Description

The state variable is declared at L106 and written once during initialization:

// Stratax.sol:106
// @> address public USDC;
// Stratax.sol:183
USDC = _usdc;

The protocol is fully token-agnostic. All functions (createLeveragedPosition, unwindPosition, calculateOpenParams, calculateUnwindParams) accept arbitrary token addresses as parameters. No function reads the USDC variable for routing, fee calculation, or any other purpose.

A search across the entire contract confirms this. Every occurrence of USDC in Stratax.sol:

  • L106: Declaration (address public USDC)

  • L178: Parameter in initialize() signature (address _usdc)

  • L183: Assignment (USDC = _usdc)

There are zero reads. The auto-generated public getter exists but is never called internally.

This is particularly misleading because the variable name USDC implies the protocol has hardcoded USDC handling, which could lead integrators to assume USDC-denominated positions have different behavior. They don't.

Risk

Likelihood: High -- Present in every deployment. The unused parameter must be passed to initialize() on every proxy creation.

Impact: Low -- No financial impact. Wastes one 32-byte storage slot per proxy. The unused _usdc parameter in initialize() adds deployment complexity and a potential misconfiguration surface for no benefit.

Proof of Concept

$ grep -n "USDC" src/Stratax.sol
106: address public USDC;
178: address _usdc,
183: USDC = _usdc;

Three occurrences: declaration, parameter, assignment. Zero reads. The variable is write-only.

Recommended Mitigation

Remove the unused variable and its initialization parameter to save a storage slot and reduce confusion:

- address public USDC;
function initialize(
address _aavePool,
address _aaveDataProvider,
address _oneInchRouter,
- address _usdc,
address _strataxOracle
) external initializer {
aavePool = IPool(_aavePool);
aaveDataProvider = IProtocolDataProvider(_aaveDataProvider);
oneInchRouter = IAggregationRouter(_oneInchRouter);
- USDC = _usdc;
strataxOracle = _strataxOracle;
owner = msg.sender;
flashLoanFeeBps = 9;
}

If USDC is planned for future use (e.g., fee collection or default quote currency), document the intent with a comment explaining the planned usage.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!