hats-finance / Palmera-0x5fee7541ddcd51ba9f4af606f87b2c42eea655be

Palmera hierarchical module
0 stars 4 forks source link

Wrong FALLBACK_HANDLER on some chains #42

Open hats-bug-reporter[bot] opened 3 months ago

hats-bug-reporter[bot] commented 3 months ago

Github username: -- Twitter username: SBSecurity_ Submission hash (on-chain): 0x7e140aa512973250542df3eae3ffe7269d03baf2f87d6f42acf1bf1fff545840 Severity: high

Description: Description\ A hardcoded fallback handler address is used, while Palmera is intended to be deployed on many chains. On Gnosis chain for example the address of FALLBACK_HANDLER is not 0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4, but 0xfd0732Dc9E303f09fCEf3a7388Ad10A83459Ec99, same applies for Arbitrum and other chains Attack Scenario\ Describe how the vulnerability can be exploited.

Attachments

address internal constant FALLBACK_HANDLER =
        0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4;
  1. Proof of Concept (PoC) File
  2. Revised Code File (Optional) replace the wrong hardcoded addresses
0xRizwan commented 3 months ago

Non-issue, informational at best. 0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4 is for Etereum mainnet and its true that fallback address is different, for example in case of Gnosis. It should be noted that, FALLBACK_HANDLER is NOT used anywhere in contracts so this is not an issue.

alfredolopez80 commented 3 months ago

totally agree @0xRizwan