HonorLt - Hardcoded WETH

[sherlock-admin]

HonorLt

medium

Hardcoded WETH

Summary

The address of WETH is hardcoded but it differs on other chains.

Vulnerability Detail

The swap library has WETH hardcoded:

address internal constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2;

It is used when performing a multi-token swap (tokenA -> WETH -> tokenB).

The scope mentions these deployment environments:
DEPLOYMENT: Mainnet, Arbitrum, Optimism, Polygon, Binance Smart Chain

This hardcoded WETH address does not match other chains. For example, on Arbitrum the address is: https://arbiscan.io/token/0x82af49447d8a07e3bd95bd0d56f35241523fbab1

What is more, the next variable (gasUsedForSwap) is not used anywhere so I was not sure what is the purpose of it:

  uint256 internal constant gasUsedForSwap = 210000;

Impact

The current code of the swap library will only work on mainnet and needs to be manually adjusted before deploying on other chains. If accidentally deployed as it is, then when the time comes to perform the multi-swap, it will throw a runtime error.

Code Snippet

https://github.com/sherlock-audit/2023-01-derby/blob/main/derby-yield-optimiser/contracts/libraries/Swap.sol#L28

Tool used

Manual Review

Recommendation

Inject the WETH address as a parameter.

Duplicate of #308

[pauliax]

Escalate for 10 USDC.

This was closed and excluded with no explanation while it is clearly a duplicate of #308.

[sherlock-admin]

Escalate for 10 USDC.

This was closed and excluded with no explanation while it is clearly a duplicate of #308.

You've created a valid escalation for 10 USDC!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[hrishibhat]

Escalation accepted

Valid duplicate of #308

[sherlock-admin]

Escalation accepted

Valid duplicate of #308

This issue's escalations have been accepted!

Contestants' payouts and scores will be updated according to the changes made on this issue.