Submitted by Ruhum, also found by 0xf15ers, cccz, hake, Soosh, and WatchPug
The Comptroller contract uses a hardcoded address for the WETH contract which is not the correct one. Because of that, it will be impossible to claim COMP rewards. That results in a loss of funds so I rate it as HIGH.
The Comptrollers getWETHAddress() function: https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Comptroller.sol#L1469
Its a left-over from the original compound repo: https://github.com/compound-finance/compound-protocol/blob/master/contracts/Comptroller.sol#L1469
Its used by the grantCompInternal() function: https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Comptroller.sol#L1377
That function is called by claimComp(): https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/Comptroller.sol#L1365
If there is a contract stored in that address and it doesnt adhere to the interface (doesnt have a balanceOf() and transfer() function), the transaction will revert. If there is no contract, the call will succeed without having any effect. In both cases, the user doesnt get their COMP rewards.
The WETH contracts address should be parsed to the Comptroller through the constructor or another function instead of being hardcoded.
tkkwon1998 (Canto) confirmed
Alex the Entreprenerd (judge) commented:
