Improve a function MultiSigWalletFactory.create()
#44
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is no access control in the initialize function of the MultiSigWallet contract, which allows anyone to reinitialize the contract with arbitrary input.
function initialize(
address _factory,
string memory _name,
string memory _description,
address _creator,
address[] memory _members,
uint256 _required
) public {
...
}
The first create2 operation in the create function is redundant since it will deploy a meaningless with the bytecode based on the calldata to the create function.
The salt parameter used in the creation of a MultiSigWallet contract can be influenced by the block.number at the time of deployment. It is possible that Alice was unable to recover her wallet after a chain reorganization because the block.number had changed since the initial deployment of the contract. As a result, the wallet address associated with the contract may not be the same as the one to which Alice sent her funds.
We recommend the team revert to using the constructor function to initialize the MultiSigWallet. Actually, the official documents of Solidity (https://docs.soliditylang.org/en/v0.8.2/control-structures.html#salted-contract-creations-create2) provide a tutorial for deploying the contract with the create2 opcode by using the new keyword.
Additionally, we recommend that the team use msg.sender along with a user-assigned value to calculate the salt. This user-assigned value, seed, can enable one account to create multiple wallets.