CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: gas
Valid

Address Collusion

torpedopistolixc41

Summary

Address collusion may occur with create2 with low probability.

Vulnerability Details

In case newescrow function fails cause of address collusion user lose huge amount of gas . if we check the codesize before deployment and see if any contract deployment exist with the computed address we can revert with a low gas loss.
In the test case which is testSameSaltReverts in EscrowFactory test suit in case same salt used can lead to same address so in revert phase with customized code-block ; loss of gas minimal.Down below you can see the difference of gas in test suits

Recommendations

    //EscrowFactoryTest:testSameSaltReverts() (gas: 8937393460516713538) --> before implementation!
    //EscrowFactoryTest:testSameSaltReverts() (gas: 765957)              --> after  implementation!
   
      uint codesz;
     assembly { 
        codesz := extcodesize(computedAddress) 
        }
    if(codesz !=0) revert EscrowFactory__ContractAlreadyDeployed();

code update down below

function newEscrow(
uint256 price,
IERC20 tokenContract,
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt
) external returns (IEscrow) {
address computedAddress = computeEscrowAddress(
type(Escrow).creationCode,
address(this),
uint256(salt),
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);
uint codesz;
assembly {
codesz := extcodesize(computedAddress)
}
if(codesz !=0) revert EscrowFactory__ContractAlreadyDeployed();
​
tokenContract.safeTransferFrom(msg.sender, computedAddress, price);
Escrow escrow = new Escrow{salt: salt}(
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);
if (address(escrow) != computedAddress) {
revert EscrowFactory__AddressesDiffer();
}
emit EscrowCreated(address(escrow), msg.sender, seller, arbiter);
return escrow;
}

Tools Used

Foundry-test suits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.