From f6c796e957ebed61bc22d7b9624d8428ce6afb0e Mon Sep 17 00:00:00 2001
From: hazim-j <hazim.jumali@gmail.com>
Date: Mon, 4 Aug 2025 11:48:03 +1000
Subject: [PATCH] Findings 33: document address collision edgecase with same
 refHash

---
 src/account/KeystoreAccountFactory.sol | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/account/KeystoreAccountFactory.sol b/src/account/KeystoreAccountFactory.sol
index 1931605..e70bc72 100644
--- a/src/account/KeystoreAccountFactory.sol
+++ b/src/account/KeystoreAccountFactory.sol
@@ -22,6 +22,11 @@ contract KeystoreAccountFactory {
         senderCreator = _entryPoint.senderCreator();
     }
 
+    /**
+     * @dev refHash may not be unique for every account if the same initial
+     * UserConfiguration Merkle Tree is used. In this case a unique salt value
+     * must be used to avoid address collision.
+     */
     function createAccount(bytes32 refHash, uint256 salt) public returns (KeystoreAccount ret) {
         require(msg.sender == address(senderCreator), NotFromSenderCreator());
         address addr = getAddress(refHash, salt);