Omniscia Rari Capital Audit
CTokenInterfaces Manual Review Findings
CTokenInterfaces Manual Review Findings
CTI-01M: Inexistent Hardcoded Contract Address
Type | Severity | Location |
---|---|---|
Language Specific | Minor | CTokenInterfaces.sol:L11 |
Description:
The address of the fuseAdmin
contract is hard-coded, however, no contracts or activity was detected across chains.
Example:
contracts/CTokenInterfaces.sol
7contract CTokenAdminStorage {8 /**9 * @notice Administrator for Fuse10 */11 IFuseFeeDistributor internal constant fuseAdmin = IFuseFeeDistributor(0x2279B7A0a67DB372996a5FaB50D91eAA73d2eBe6);1213 /**14 * @notice Administrator for this contract15 */16 address payable public admin;1718 /**19 * @notice Whether or not the Fuse admin has admin rights20 */21 bool public fuseAdminHasRights = true;2223 /**24 * @notice Whether or not the admin has admin rights25 */26 bool public adminHasRights = true;2728 /**29 * @notice Returns a boolean indicating if the sender has admin rights30 */31 function hasAdminRights() internal view returns (bool) {32 return (msg.sender == admin && adminHasRights) || (msg.sender == address(fuseAdmin) && fuseAdminHasRights);33 }34}
Recommendation:
We advise that this is instead set as immutable
and passed during construction time as the address is not pre-existing and thus may require a change prior to deployment that may be overlooked.
Alleviation:
The hard-coding of the address is intended by the Rari team and they have stated that it will be updated prior to launch properly.