Hardcoded default value for the gateway address [code-improvement]

[0xM3R]

File: deploy.ts
Issue: Hardcoded default value for the gateway address.

Analysis

The vulnerable implementation is as follows:

.addOptionalParam(
    "gateway",
    "Gateway address (default: ZetaChain Gateway)",
    "0x6c533f7fe93fae114d0954697069df33c9b74fd7"
);

• Hardcoded Value: The gateway address is set to a default value, which may not be suitable for all deployment environments.

How It Can Be Harmful

• Predictability: Hardcoded addresses can be exploited if attackers anticipate their use.
• Misconfigurations: Deployments may malfunction if the default address is incorrect for the target environment.

How to Mitigate the Issue

1. Validate Configurations: Ensure the args.gateway is valid during runtime.

if (!isAddress(args.gateway)) {
    throw new Error("Invalid gateway address.");
}

2. Use Environment Variables: Replace hardcoded values with environment variables to allow flexibility across different environments.

References

• OpenZeppelin Adjustable Parameters
  Guidance on implementing adjustable parameters to improve contract flexibility.
  OpenZeppelin Blog

[fadeev]

Gateway and Uniswap router addresses are hardcoded only for UX purposes. Otherwise, devs would have to copy paste them every single time. I don't think there is a solution for this issue that wouldn't affect the dev experience.