Platform: Code4rena
Start Date: 07/07/2023
Pot Size: $121,650 USDC
Total HM: 36
Participants: 111
Period: 7 days
Judge: Picodes
Total Solo HM: 13
Id: 258
League: ETH
Rank: 48/111
Findings: 1
Award: $215.72
🌟 Selected for report: 1
🚀 Solo Findings: 0
🌟 Selected for report: gzeon
Also found by: 0xMirce, Breeje, Inspecktor, ptsanev
215.7232 USDC - $215.72
Vaults are created from the factory via CREATE1, an attacker can frontrun deployVault to deploy at the same address but with different config. If the deployed chain reorg, a different vault might also be deployed at the same address.
Use CREATE2 and the vault config as salt.
MEV
#0 - c4-judge
2023-07-16T21:53:33Z
Picodes marked the issue as primary issue
#1 - asselstine
2023-07-20T22:45:03Z
The Vault address is derivative of the (sender address, nonce). I don't see how this scenario is possible?
#2 - c4-sponsor
2023-07-20T22:45:09Z
asselstine marked the issue as sponsor disputed
#3 - Picodes
2023-08-06T22:35:53Z
@asselstine exactly, so here it only depends on the nonce of the factory, so in case of reorg someone could "override" a vault deployment and all following transactions would still be executed
#4 - c4-judge
2023-08-06T22:35:58Z
Picodes marked the issue as satisfactory
#5 - c4-judge
2023-08-06T22:36:02Z
Picodes marked the issue as selected for report
#6 - asselstine
2023-08-17T21:23:18Z