Surfaced during the 2026-08-24 adversarial-mutation-test campaign and dropped without disposition — filing it so it reaches triage rather than being lost between groups.
Unit
ICloneableFactoryV3.NewClone NatSpec, and the open-salt derivation in LibICloneableFactoryV4.
Intent oracle
ICloneableFactoryV3's NatSpec for NewClone states the clone address is a pure function of (implementation, sender, salt).
Violated property
That holds on the namespaced derivation, where the effective salt is keccak256(abi.encode(NAMESPACE_DOMAIN, deployer, salt)), so msg.sender is genuinely one of the address's determinants.
It does not hold on the open-salt derivation. There the effective salt is keccak256(abi.encode(OPEN_SALT_DOMAIN, salt, keccak256(data))) — data is a determinant and sender is deliberately not one. ICloneableFactoryV4:96-107 states this as a MUST NOT: the open-salt derivation MUST NOT mix msg.sender, tx.origin, or any other caller-derived value.
So a reader taking the V3 event documentation at face value on a V4 factory would conclude the address depends on the caller and not on data, which is backwards on that path. Two consequences worth triaging: an indexer or offchain predictor written against the V3 text computes the wrong address for open-salt clones, and the caller-independence that the open-salt front-running argument rests on is contradicted by the event's own documentation.
Framing
This may be intended as-is: NewClone is declared by V3, whose own derivation is namespaced, and the V4 interface is where the open-salt contract is specified. The question for triage is whether V3's event NatSpec should be scoped to V3's derivation, or whether a factory implementing both derivations needs event documentation that covers both — related to #65, which records that NewClone is declared by three interfaces under two signatures.
Provenance
Group g3 of the campaign surfaced this and filed #61–#64 without including it; the completeness critic caught the omission. No repro is attached because the finding is a documentation/contract mismatch, checkable by reading ICloneableFactoryV3.sol against ICloneableFactoryV4.sol:96-107 and LibICloneableFactoryV4.effectiveOpenSalt.
Surfaced during the 2026-08-24 adversarial-mutation-test campaign and dropped without disposition — filing it so it reaches triage rather than being lost between groups.
Unit
ICloneableFactoryV3.NewCloneNatSpec, and the open-salt derivation inLibICloneableFactoryV4.Intent oracle
ICloneableFactoryV3's NatSpec forNewClonestates the clone address is a pure function of(implementation, sender, salt).Violated property
That holds on the namespaced derivation, where the effective salt is
keccak256(abi.encode(NAMESPACE_DOMAIN, deployer, salt)), somsg.senderis genuinely one of the address's determinants.It does not hold on the open-salt derivation. There the effective salt is
keccak256(abi.encode(OPEN_SALT_DOMAIN, salt, keccak256(data)))—datais a determinant andsenderis deliberately not one.ICloneableFactoryV4:96-107states this as a MUST NOT: the open-salt derivation MUST NOT mixmsg.sender,tx.origin, or any other caller-derived value.So a reader taking the V3 event documentation at face value on a V4 factory would conclude the address depends on the caller and not on
data, which is backwards on that path. Two consequences worth triaging: an indexer or offchain predictor written against the V3 text computes the wrong address for open-salt clones, and the caller-independence that the open-salt front-running argument rests on is contradicted by the event's own documentation.Framing
This may be intended as-is:
NewCloneis declared by V3, whose own derivation is namespaced, and the V4 interface is where the open-salt contract is specified. The question for triage is whether V3's event NatSpec should be scoped to V3's derivation, or whether a factory implementing both derivations needs event documentation that covers both — related to #65, which records thatNewCloneis declared by three interfaces under two signatures.Provenance
Group g3 of the campaign surfaced this and filed #61–#64 without including it; the completeness critic caught the omission. No repro is attached because the finding is a documentation/contract mismatch, checkable by reading
ICloneableFactoryV3.solagainstICloneableFactoryV4.sol:96-107andLibICloneableFactoryV4.effectiveOpenSalt.