Party and crowdfunding creation is subject to reorg attacks

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-party/blob/440aafacb0f15d037594cebc85fd471729bcb6d9/contracts/party/PartyFactory.sol#L18-L45
https://github.com/code-423n4/2023-04-party/blob/440aafacb0f15d037594cebc85fd471729bcb6d9/contracts/crowdfund/CrowdfundFactory.sol#L56-L222

Vulnerability details

Impact

Party creation can be reorganized to steal user funds

Proof of Concept

https://github.com/code-423n4/2023-04-party/blob/440aafacb0f15d037594cebc85fd471729bcb6d9/contracts/party/PartyFactory.sol#L36-L43

    party = Party(
        payable(
            new Proxy(
                Implementation(address(partyImpl)),
                abi.encodeCall(Party.initialize, (initData))
            )
        )
    );

Each time a new party or crowdfund is made it uses create opcode rather than create2. Create is sole dependent on the deployer (the factory contract) and its nonce. This opens the door for potential reorg attacks. While not too much of a problem for Ethereum, this is a serious issues for a large number of EVM compatible L1's and L2's.

Example:
User A creates a new party and soon after contributes to their party. An attacker sees this and reorg attacks the contract creation. They rearrange the blockchain and deploy their own malicious party prior which now has the address of the previously legitimate party. The cause User A's contribution to be made to the malicious party rather than their party.

Tools Used

Manual Review

Recommended Mitigation Steps

Utilize the create2 opcode rather than the create opcode

[0xean]

From the c4 docs

Unless there is something uniquely novel created by combining vectors, most submissions regarding vulnerabilities that are inherent to a particular system or the Ethereum network as a whole should be considered QA. Examples of such vulnerabilities include front running, sandwich attacks, and MEV. In such events, leave a comment on the issue:

I believe this not to be unique to the protocol and an inherent trait of blockchains that lack instant finality. Downgrading to QA

[c4-judge]

0xean changed the severity to QA (Quality Assurance)

[c4-sponsor]

0xble marked the issue as sponsor acknowledged

[c4-judge]

0xean marked the issue as grade-b