search

code-423n4 / 2023-08-pooltogether-mitigation-findings

0 stars 0 forks source link

M-08 MitigationConfirmed #48

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Issue mitigated

About the problem

This report is about reorg on the chain. In case if someone has created vault and sent funds to it and then reorg happens, then attacker can frontrun vault deploying in order to deploy that vault for himself and receive victim's funds. Usually, such bugs are not awarded as medium on c4.

Solution

As it was proposed by wardens, pool together team fixed issue with using create2 for vault deploying. Salt depends on caller and it's nonce. So in case of reorg, vault with same address will be created and funds will be safe.

c4-judge commented 1 year ago

Picodes marked the issue as satisfactory