F-2026-0025·interface-signature-mismatch

Extra argument in WrappedToken initialization is ignored

Fixedbridgecross-chainkey-registrygithub.com/pdxwebdev/yadakeyeventwallet

TL;DR

registerKeyPairWithTransfer ABI-encodes 4 arguments to WrappedToken.initialize, but the implementation only declares 3, so the keyLogRegistry parameter is silently ignored.

Severity

LOW

Impact

LOW

Likelihood

HIGH

Method

MManual review

CAT.

Complexity

LOW

Exploitability

LOW

02Section · Description

Description

In Bridge::registerKeyPairWithTransfer the code constructs initData for the new wrapped token proxy using abi.encodeWithSelector and passes four arguments (name, symbol, bridge address, keyLogRegistry address):

solidity

bytes memory initData = abi.encodeWithSelector(
    WrappedToken.initialize.selector,
    pair.tokenName,
    pair.tokenSymbol,
    address(this),
    address(keyLogRegistry)
);
WrappedTokenProxy proxy = new WrappedTokenProxy(wrappedTokenBeacon, initData);

However, the WrappedToken implementation initialize signature expects only three parameters:

solidity

function initialize(
    string memory name,
    string memory symbol,
    address _bridge
) public initializer {
    __ERC20_init(name, symbol);
    __ERC20Permit_init(name);
    __Ownable_init(_bridge);
    __UUPSUpgradeable_init();
    bridge = _bridge;
}

This is also found in WrappedTokenFactory::createToken where the Interface IWrappedToken does not match the implementation (WrappedToken::initialize).

03Section · Recommendation

Recommendation

Make the initialize function in WrappedToken.sol accept the extra keyLogRegistry parameter:

solidity

function initialize(
    string memory name,
    string memory symbol,
    address _bridge,
    address _keyLogRegistry
) public initializer {
    __ERC20_init(name, symbol);
    __ERC20Permit_init(name);
    __Ownable_init(_bridge);
    __UUPSUpgradeable_init();
    bridge = _bridge;
    keyLogRegistry = KeyLogRegistry(_keyLogRegistry);
}

04Section · Resolution

Resolution

YadaCoin, Confirmed.

Zealynx, Fixed.

Status

Fixed