search

hats-finance / Velvet-Capital-0x0bb0c08fd9eeaf190064f4c66f11d18182961f77

Core smart contracts of Velvet Capital
Other
0 stars 1 forks source link

Hard Coded Value can become a DOS Issue #112

Open hats-bug-reporter[bot] opened 2 months ago

hats-bug-reporter[bot] commented 2 months ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x227834fdffe74832b3d90051b5e9b71f198a4e5f21b40e4e99355a3304f53f49 Severity: medium

Description: Description\ Hard Coded Value os SWAP_TARGET can become a DOS Issue on the expansion of Velvet Capital to new chains

Attack Scenario\ While the EnsoShortCut has been deployed to 0x38147794FF247e5Fc179eDbAE6C37fff88f68C52 on a bunch of chains like Ethereum, Polygon, Arbitrum. The hard-coded value still limits the expansion on a new chain. An attacker using CREATE3 can mint this address on a different chain to cause DOS or ransom for the project

Attachments

  1. Proof of Concept (PoC) File https://blastscan.io/address/0x38147794FF247e5Fc179eDbAE6C37fff88f68C52

  2. Revised Code File (Optional) Set the SWAP_TARGET on deployment in the constructor to allow dynamic setting of the SWAP_TARGET

langnavina97 commented 2 months ago

There is no dependency on the core protocol, so the contract can be redeployed without any issues.