Sparkn

Summary

The signature used in ProxyFactory::deployProxyAndDistributeBySignature() is missing a nonce & expiration deadline.

Vulnerability Details

The signature used in ProxyFactory::deployProxyAndDistributeBySignature() is missing a nonce & expiration deadline.

Impact

This doesn't appear to currently be directly exploitable as ProxyFactory::_distribute() can't be called using the signature but without attempting to deploy the proxy. However the project team has stated they will be upgrading the contracts and that the current code is just an initial version, so best to point this out now as a low finding to prevent it from becoming a medium/high in a future version of the codebase.

Tools Used

Manual

Recommendations

Implement a nonce and an expiration deadline.