Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ETHEREUM-CONTRACTS] Avoid (unwanted) same address of tokens and/or pools across chains #2024

Open
2 tasks
d10r opened this issue Sep 30, 2024 · 0 comments
Open
2 tasks

Comments

@d10r
Copy link
Collaborator

d10r commented Sep 30, 2024

What & Why

SuperToken wrappers and Pools created by framework contracts can end up having the same address as another artifact on another chain. This is not per se an issue, but can cause confusion (e.g. in cross-chain searches like in console) and may be abused by phishers.

We should thus check the extent of the problem and potentially do something about it.

Issue Origin: https://discord.com/channels/752490247643725875/752493348169711696/1288506722352369666

AC

  • Enumerate the relevant (factory) contracts and check address matches across chains
  • Elaborate a recommendation for what to do about it

Technical

This can happen because of a combination of 2 factors:

  1. use of the same deployer EOA across chains (the "GH-Agent account"). Depending on the somewhat random order of transaction, this can lead to deployed contracts having the same address (determined by nonce) as contracts (can be the same of a different one) on another chain.
  2. contracts created by those contracts again have their address derived from the nonce because CREATE (the conventional one) is used.

If we eliminate one of those factors, no accidental address matches are possible.
While we can't easily change the address of framework contracts (the proxies), we could do an update which switches factories to using CREATE2, making sure the nonce eliminates conflicts (e.g. including chainId).

This is somewhat related to the "canonical SuperToken wrapper feature" (see createCanonicalERC20Wrapper) which was never rolled out. In case we do something here, we may want to tackle that one too, but maybe a simpler version of it which is easier to rollout and maintain.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant