search

sherlock-audit / 2024-03-zap-protocol-judging

3 stars 1 forks source link

gkrastenovaudit - Wrongly hard-coded address #182

Closed sherlock-admin2 closed 7 months ago

sherlock-admin2 commented 7 months ago

gkrastenovaudit

high

Wrongly hard-coded address

Summary

Wrongly hard-coded address.

Vulnerability Detail

The address of the USDB token is wrongly hard-coded. The following address, 0xA9F81589Cc48Ff000166Bf03B3804A0d8Cec8114, is the address of USDB on the Sepolia Testnet network. link

The protocol will not work as expected because this address does not exist on the Mainnet, where the smart contract will be deployed.

https://blastexplorer.io/address/0xA9F81589Cc48Ff000166Bf03B3804A0d8Cec8114

Impact

The main functionalities of the protocol it will not work.

Code Snippet

https://github.com/sherlock-audit/2024-03-zap-protocol/blob/main/zap-contracts-labs/contracts/TokenSale.sol#L88

 usdc = IERC20D(0xA9F81589Cc48Ff000166Bf03B3804A0d8Cec8114); //TODO change for mainnet

Tool used

Manual Review

Recommendation

Change the hard-coded address.