Audit finding CQ4-01 — dimension 4, severity INFO. Whole-repo audit pass 1 at 440e90b5.
test/src/lib/LibRainDeploy.t.sol:9,12
Problem
The import block declares import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol"; at line 9 and again, verbatim, at line 12. solc tolerates the repeated import of an identical declaration, so it compiles and nothing fails — which is exactly why it survives: a redundant line in a hand-maintained import block is the shape a bad merge or a copy-paste leaves behind, and the next reader has to check whether the two lines differ before concluding they do not. No other file in the repo imports one symbol twice, so this is the single outlier against a repo-wide convention of one import per symbol.
Proposed fix
Delete the duplicate at line 12.
Before (lines 9-15):
import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";
import {MockResolvedOwner} from "../../concrete/MockResolvedOwner.sol";
import {MockDirtyWordOwner} from "../../concrete/MockDirtyWordOwner.sol";
import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";
import {MockDeployable} from "../../concrete/MockDeployable.sol";
import {MockDeployableV2} from "../../concrete/MockDeployableV2.sol";
import {MockReverter} from "../../concrete/MockReverter.sol";
After:
import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";
import {MockResolvedOwner} from "../../concrete/MockResolvedOwner.sol";
import {MockDirtyWordOwner} from "../../concrete/MockDirtyWordOwner.sol";
import {MockDeployable} from "../../concrete/MockDeployable.sol";
import {MockDeployableV2} from "../../concrete/MockDeployableV2.sol";
import {MockReverter} from "../../concrete/MockReverter.sol";
Verification — this finding survived an adversarial refutation pass
Confirmed against source at 440e90b. test/src/lib/LibRainDeploy.t.sol lines 9 and 12 are byte-identical imports of MockAddressRevertingFactory from ../../concrete/MockAddressRevertingFactory.sol. Refutation attempts all failed: (1) the cited lines say exactly what the finding claims; (2) the symbol IS used (lines 402, 1144), so this is a redundant duplicate line, not a mischaracterized dead import — the proposed fix (delete line 12) is correct as written; (3) the repo-wide-outlier claim holds — a per-file duplicate-import scan over src/, test/, script/ returns this file as the only true hit, the three other hits being the literal string "import {" opening multi-line import blocks in RegistryDeploySuites.sol, RainDeployVerifyChain.t.sol and RainDeployVerifySnapshot.t.sol, which are false positives rather than duplicated symbols; (4) no existing guard or tooling handles it — nix develop -c forge fmt --check exits 0 on the tree as-is so the formatter neither flags nor removes it, slither.config.json excludes only the assembly detector, and solc silently tolerates a repeated identical declaration, so none of the three CI matrix tasks catch it; (5) CLAUDE.md documents no convention sanctioning it. Severity corrected LOW -> INFO: value-at-risk in production is zero. This is a test-only file, and the duplicate line has no runtime, compilation, or behavioural effect whatsoever — the finding's own text concedes "it compiles and nothing fails". The entire cost is a future reader briefly diffing two lines. Under severity-by-production-impact that is INFO, not LOW.
Audit finding
CQ4-01— dimension 4, severity INFO. Whole-repo audit pass 1 at440e90b5.test/src/lib/LibRainDeploy.t.sol:9,12Problem
The import block declares
import {MockAddressRevertingFactory} from "../../concrete/MockAddressRevertingFactory.sol";at line 9 and again, verbatim, at line 12. solc tolerates the repeated import of an identical declaration, so it compiles and nothing fails — which is exactly why it survives: a redundant line in a hand-maintained import block is the shape a bad merge or a copy-paste leaves behind, and the next reader has to check whether the two lines differ before concluding they do not. No other file in the repo imports one symbol twice, so this is the single outlier against a repo-wide convention of one import per symbol.Proposed fix
Delete the duplicate at line 12.
Before (lines 9-15):
After:
Verification — this finding survived an adversarial refutation pass
Confirmed against source at 440e90b. test/src/lib/LibRainDeploy.t.sol lines 9 and 12 are byte-identical imports of MockAddressRevertingFactory from ../../concrete/MockAddressRevertingFactory.sol. Refutation attempts all failed: (1) the cited lines say exactly what the finding claims; (2) the symbol IS used (lines 402, 1144), so this is a redundant duplicate line, not a mischaracterized dead import — the proposed fix (delete line 12) is correct as written; (3) the repo-wide-outlier claim holds — a per-file duplicate-import scan over src/, test/, script/ returns this file as the only true hit, the three other hits being the literal string "import {" opening multi-line import blocks in RegistryDeploySuites.sol, RainDeployVerifyChain.t.sol and RainDeployVerifySnapshot.t.sol, which are false positives rather than duplicated symbols; (4) no existing guard or tooling handles it —
nix develop -c forge fmt --checkexits 0 on the tree as-is so the formatter neither flags nor removes it, slither.config.json excludes only the assembly detector, and solc silently tolerates a repeated identical declaration, so none of the three CI matrix tasks catch it; (5) CLAUDE.md documents no convention sanctioning it. Severity corrected LOW -> INFO: value-at-risk in production is zero. This is a test-only file, and the duplicate line has no runtime, compilation, or behavioural effect whatsoever — the finding's own text concedes "it compiles and nothing fails". The entire cost is a future reader briefly diffing two lines. Under severity-by-production-impact that is INFO, not LOW.