Summary

The new contract address deployed from the TokenFactory is predictable and this can lead to

Vulnerability Details

Because of using the create opcode the new address will be calculated in the following way:

Hashing the address of the account that created it.
Hashing the 'account nonce', which is equivalent to the number of transactions completed by the account so far.
new_address = keccak256(sender, nonce);

Impact

A malicious actor, knowing the next address in advance, can exploit this by deploying a contract at the predicted address ahead of the legitimate user. They could deploy a contract with malicious intent or simply to disrupt normal operations.

Tools Used

Manual analysis

Recommendations

Use opcode create2 instead of create