Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Use of `create` in `TadleFactory.sol` is vulnerable to ChainReorgs

0xshoonya

Summary

The deployUpgradeableProxy function in TadleFactory.sol uses the create opcode to deploy new proxy instances. This method is vulnerable to chain reorgs, which are prevalent on Ethereum and other EVM-compatible chains.

Vulnerability Details

TadleFactory.sol deploys new proxy instances using create in deployUpgradeableProxy function

function deployUpgradeableProxy(
uint8 _relatedContractIndex,
address _logic,
bytes memory _data
) external onlyGuardian returns (address) {
/// @dev the logic address must be a contract
if (!_logic.isContract()) {
revert LogicAddrIsNotContract(_logic);
}
​
/// @dev deploy proxy
@> UpgradeableProxy _proxy = new UpgradeableProxy(
_logic,
guardian,
address(this),
_data
);
relatedContracts[_relatedContractIndex] = address(_proxy);
emit RelatedContractDeployed(_relatedContractIndex, address(_proxy));
return address(_proxy);
}

As stated in the protocol's README Tadle is compatible with "Ethereum/Any EVM"
Chain reorgs are very prevalent in Ethereum mainnet and also on L2's like Arbitrum or Polygon or Blast,etc.
These re-orgs can potentially invalidate the deployment of the proxy instances, leading to issues with the Tadle protocol.

Ethereum: forked blocks index
Polygon: 157 blocks depth
Optimistic rollups (Optimism/Arbitrum) are also suspect to reorgs since if someone finds a fraud the blocks will be reverted, even though the user receives a confirmation.

Impact

Current deployment method of the proxy contracts is unsafe considering a re-org attack would allow an attacker take over the contract, also protocol has stated they are to deploy on any EVM compatible chain which then heavily increases the likelihood of this occurring.

Tools Used

Manual Review

Recommendations

Consider using create2 and a non-constant salt value when deploying.

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.