Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve a function MultiSigWalletFactory.create() #44

Merged
merged 4 commits into from
May 22, 2024

Conversation

MichaelKim20
Copy link
Member

@MichaelKim20 MichaelKim20 commented May 22, 2024

  1. There is no access control in the initialize function of the MultiSigWallet contract, which allows anyone to reinitialize the contract with arbitrary input.
    function initialize(
    address _factory,
    string memory _name,
    string memory _description,
    address _creator,
    address[] memory _members,
    uint256 _required
    ) public {
    ...
    }

  2. The first create2 operation in the create function is redundant since it will deploy a meaningless with the bytecode based on the calldata to the create function.

  3. The salt parameter used in the creation of a MultiSigWallet contract can be influenced by the block.number at the time of deployment. It is possible that Alice was unable to recover her wallet after a chain reorganization because the block.number had changed since the initial deployment of the contract. As a result, the wallet address associated with the contract may not be the same as the one to which Alice sent her funds.
    We recommend the team revert to using the constructor function to initialize the MultiSigWallet. Actually, the official documents of Solidity (https://docs.soliditylang.org/en/v0.8.2/control-structures.html#salted-contract-creations-create2) provide a tutorial for deploying the contract with the create2 opcode by using the new keyword.

  4. Additionally, we recommend that the team use msg.sender along with a user-assigned value to calculate the salt. This user-assigned value, seed, can enable one account to create multiple wallets.

@MichaelKim20 MichaelKim20 merged commit 1d61ef9 into bosagora:v0.x.x May 22, 2024
1 check passed
@MichaelKim20 MichaelKim20 deleted the 2034 branch October 21, 2024 03:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant