-
Notifications
You must be signed in to change notification settings - Fork 2
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
NewClone's V3 NatSpec calls the clone address a pure function of (implementation, sender, salt), which is false on the open-salt derivation
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#79 In rainlanguage/rain.factory;CloneDeploymentFailed's "the exact clone asked for is already at the address" is false on the namespaced derivation, which leaves data out
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#74 In rainlanguage/rain.factory;checkImplementationCode admits an EIP-7702 delegated EOA, whose code the account holder can repoint or revoke after clones exist
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#73 In rainlanguage/rain.factory;Library NatSpec claims a delegating concrete cannot misroute the msg.sender namespacing, but effectiveSalt + cloneAndInitialize compose to a factory that does
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#71 In rainlanguage/rain.factory;Boundary-value coverage of the salt derivations is fuzz-seed luck: max-salt mutants survive the whole suite
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#70 In rainlanguage/rain.factory;ICloneableV2's normative NatSpec points implementers at the superseded ICloneableFactoryV2, and ICloneableV1 names a non-existent ICloneFactoryV1
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#69 In rainlanguage/rain.factory;TestCloneable, the only worked ICloneableV2 fixture, violates the interface's once-only initialize MUST that ICloneableFactoryV4's open-salt safety argument rests on
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#67 In rainlanguage/rain.factory;NewClone is declared by three published interfaces under two signatures; ICloneableFactoryV1 and V2 share one topic0
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#65 In rainlanguage/rain.factory;testCheckImplementationCodeEtched fails on unmutated main: vm.etch rejects fuzzed 0xEF-leading code
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#64 In rainlanguage/rain.factory;ICloneableFactoryV3 cross-network determinism claim omits the implementation address, contradicting ICloneableFactoryV4
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#63 In rainlanguage/rain.factory;predictDeterministicAddressOpenSalt NatSpec claims non-zero code implies initialized state, but the clone has code before initialize runs
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#62 In rainlanguage/rain.factory;InitializationFailed is not raised when the implementation does not implement ICloneableV2.initialize — caller gets bare 0x
adversarialFound by adversarial reviewFound by adversarial reviewauditAudit findingAudit findingStatus: Open.#61 In rainlanguage/rain.factory;