Closed c4-submissions closed 10 months ago
GalloDaSballo marked the issue as duplicate of #359
GalloDaSballo changed the severity to QA (Quality Assurance)
This previously downgraded issue has been upgraded by GalloDaSballo
GalloDaSballo changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/delegatexyz/delegate-registry/blob/6d1254de793ccc40134f9bec0b7cb3d9c3632bc1/src/DelegateRegistry.sol#L151-L158
Vulnerability details
Impact
In the
sweep()
function one important address is hardcoded to zero with a note to change it later at deployment but the deployment script just deploys the contract without any mentions of replacing the address with the correct one.Proof of Concept
Tools Used
Manual
Recommended Mitigation Steps
either add a constructor and a state variable to assign the correct address at deploying time or hardcode the correct address.
Assessed type
Other