M-08 MitigationConfirmed

[code423n4]

Lines of code

Vulnerability details

Original Issue

M-08 - Attacker can front-run deployVault to deploy at the same address

Details

The previous implementation of the VaultFactory used the new keyword, which uses the CREATE1 opcode to create new Vaults, this opens up the doors for a reorg attack, where an attacker can front-run deployVault to deploy at the same address but with different config.

Mitigation

As part of the mitigation, now, the VaultFactory uses the Create2 contract from OpenZeppelin, which under the hood uses the create2 opcode to deploy the Vault using the bytecode of the Vault contract & a salt.

Conclusion

The implemented mitigation solves the original issue.

[c4-judge]

Picodes marked the issue as satisfactory