Skip to content

MockAddressRevertingFactory is imported twice in the same file #71

Description

@thedavidmeister

Audit finding CQ4-01 — dimension 4, severity INFO. Whole-repo audit pass 1 at 440e90b5.

test/src/lib/LibRainDeploy.t.sol:9,12

Problem

The import block declares import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol"; at line 9 and again, verbatim, at line 12. solc tolerates the repeated import of an identical declaration, so it compiles and nothing fails — which is exactly why it survives: a redundant line in a hand-maintained import block is the shape a bad merge or a copy-paste leaves behind, and the next reader has to check whether the two lines differ before concluding they do not. No other file in the repo imports one symbol twice, so this is the single outlier against a repo-wide convention of one import per symbol.

Proposed fix

Delete the duplicate at line 12.

Before (lines 9-15):

import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";
import {MockResolvedOwner} from "../../concrete/MockResolvedOwner.sol";
import {MockDirtyWordOwner} from "../../concrete/MockDirtyWordOwner.sol";
import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";
import {MockDeployable} from "../../concrete/MockDeployable.sol";
import {MockDeployableV2} from "../../concrete/MockDeployableV2.sol";
import {MockReverter} from "../../concrete/MockReverter.sol";

After:

import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";
import {MockResolvedOwner} from "../../concrete/MockResolvedOwner.sol";
import {MockDirtyWordOwner} from "../../concrete/MockDirtyWordOwner.sol";
import {MockDeployable} from "../../concrete/MockDeployable.sol";
import {MockDeployableV2} from "../../concrete/MockDeployableV2.sol";
import {MockReverter} from "../../concrete/MockReverter.sol";

Verification — this finding survived an adversarial refutation pass

Confirmed against source at 440e90b. test/src/lib/LibRainDeploy.t.sol lines 9 and 12 are byte-identical imports of MockAddressRevertingFactory from ../../concrete/MockAddressRevertingFactory.sol. Refutation attempts all failed: (1) the cited lines say exactly what the finding claims; (2) the symbol IS used (lines 402, 1144), so this is a redundant duplicate line, not a mischaracterized dead import — the proposed fix (delete line 12) is correct as written; (3) the repo-wide-outlier claim holds — a per-file duplicate-import scan over src/, test/, script/ returns this file as the only true hit, the three other hits being the literal string "import {" opening multi-line import blocks in RegistryDeploySuites.sol, RainDeployVerifyChain.t.sol and RainDeployVerifySnapshot.t.sol, which are false positives rather than duplicated symbols; (4) no existing guard or tooling handles it — nix develop -c forge fmt --check exits 0 on the tree as-is so the formatter neither flags nor removes it, slither.config.json excludes only the assembly detector, and solc silently tolerates a repeated identical declaration, so none of the three CI matrix tasks catch it; (5) CLAUDE.md documents no convention sanctioning it. Severity corrected LOW -> INFO: value-at-risk in production is zero. This is a test-only file, and the duplicate line has no runtime, compilation, or behavioural effect whatsoever — the finding's own text concedes "it compiles and nothing fails". The entire cost is a future reader briefly diffing two lines. Under severity-by-production-impact that is INFO, not LOW.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

auditAudit findingpass1Audit pass 1 (whole-repo, 2026-08-15)severity:infoAudit severity: INFO

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions