Skip to content

NewClone's V3 NatSpec calls the clone address a pure function of (implementation, sender, salt), which is false on the open-salt derivation #79

Description

@thedavidmeister

Surfaced during the 2026-08-24 adversarial-mutation-test campaign and dropped without disposition — filing it so it reaches triage rather than being lost between groups.

Unit

ICloneableFactoryV3.NewClone NatSpec, and the open-salt derivation in LibICloneableFactoryV4.

Intent oracle

ICloneableFactoryV3's NatSpec for NewClone states the clone address is a pure function of (implementation, sender, salt).

Violated property

That holds on the namespaced derivation, where the effective salt is keccak256(abi.encode(NAMESPACE_DOMAIN, deployer, salt)), so msg.sender is genuinely one of the address's determinants.

It does not hold on the open-salt derivation. There the effective salt is keccak256(abi.encode(OPEN_SALT_DOMAIN, salt, keccak256(data)))data is a determinant and sender is deliberately not one. ICloneableFactoryV4:96-107 states this as a MUST NOT: the open-salt derivation MUST NOT mix msg.sender, tx.origin, or any other caller-derived value.

So a reader taking the V3 event documentation at face value on a V4 factory would conclude the address depends on the caller and not on data, which is backwards on that path. Two consequences worth triaging: an indexer or offchain predictor written against the V3 text computes the wrong address for open-salt clones, and the caller-independence that the open-salt front-running argument rests on is contradicted by the event's own documentation.

Framing

This may be intended as-is: NewClone is declared by V3, whose own derivation is namespaced, and the V4 interface is where the open-salt contract is specified. The question for triage is whether V3's event NatSpec should be scoped to V3's derivation, or whether a factory implementing both derivations needs event documentation that covers both — related to #65, which records that NewClone is declared by three interfaces under two signatures.

Provenance

Group g3 of the campaign surfaced this and filed #61#64 without including it; the completeness critic caught the omission. No repro is attached because the finding is a documentation/contract mismatch, checkable by reading ICloneableFactoryV3.sol against ICloneableFactoryV4.sol:96-107 and LibICloneableFactoryV4.effectiveOpenSalt.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    adversarialFound by adversarial reviewauditAudit finding

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions