Skip to content

[flashloan] AaveFlashLoan::connect() does not assert chain_id == 56 #142

@obchain

Description

@obchain

Refs #39

File: crates/charon-flashloan/src/aave.rs — AaveFlashLoan::connect()

Problem

The adapter reads chain_id from the provider and caches it but does not validate it is 56 (BSC mainnet). CLAUDE.md scope: Venus on BNB Chain only. A misconfigured RPC URL pointing at another chain will silently connect and produce flash-loan calldata targeting the wrong Aave V3 Pool address. Because Aave V3 uses different Pool addresses per chain (BSC: 0x6807dc923806fe8fd134338eabca509979a7e0cb; Ethereum: 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2), cross-chain confusion is silent at connect time and only surfaces as a revert at execution time.

Fix

anyhow::ensure!(
    chain_id == 56,
    "AaveFlashLoan: expected BSC mainnet (chain 56), connected to chain {chain_id}"
);

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinglayer:rustRust crates (core / scanner / protocols / executor / cli)priority:p2-polishNice-to-have / polish

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions