Submission Details
Severity:
In case of a compromised deployer private key, a bad actor can launch a malicious contract with the same address as the original Escrow, but on a different chain, and phish users
Description
For EOAs, when deploying a contract the address of the contract is determined by the address itself and nonce.
If the deployer private key is ever compromised and no transactions have been made on other EVM chains, a threat actor actor with access to the key can deploy a malicious contract at the same address, but on a different chain, and phish users into interacting with it.
Recommend Mitigation
While this issue is very unlikely, it can easily be mitigated by using a fresh deployment address and doing 1 transaction on all the major EVM chains / L2s.
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.