Submitted by xuwinnie
https://github.com/code-423n4/2024-07-optimism/blob/70556044e5e080930f686c4e5acde420104bb2c4/packages/contracts-bedrock/src/dispute/DisputeGameFactory.sol#L116https://github.com/Vectorized/solady/blob/a95f6714868cfe5d590145f936d0661bddff40d2/src/utils/LibClone.sol#L458https://github.com/code-423n4/2024-07-optimism/blob/70556044e5e080930f686c4e5acde420104bb2c4/packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol#L319
When block re-org takes place, honest partys move could become invalid. A similar issue has been raised earlier, and this report shows two new scenarios, which the fix fails to address.
A new parameter _claim has been added to ensure the target is the expected one, but this is still not enough.
The factory uses create instead of create2 to deploy the proxy, consider the following scenario:
Alice and Bob are friends actually and they use another smart contract to interact with the factory and game. At the end of step 1 and 3, A,P and C,Q are stored in the contract, and in step 2 and 4, the contract executes P.move(A,...)and Q.move(C,...). Coco simply uses an eoa at step 5.
Then reorg happens, transaction order becomes 34125. The address of game P and Q are swapped (since the deployed address is derived from sender and nonce). Now it will look like:
Alice and Bob are still in their desired game but Coco will be in a wrong game. As a result, her bond will be lost.
Suppose create2 is used to address the previous scenario, but within the same game, reorg could still impact the honest party. Consider the following scenario:
Now reorg happens again, new transaction order is 1267534. Alice uses the previously mentioned contract call trick(store claim and index this time) so that her txs do not revert. Then at step 5, Cocos tx will succeed since disputed hash is the same. But her defend will now imply C and E are both valid, so shell lose her bond again.
Chain reorgs are very prevalent in Ethereum mainnet, we can check this index of reorged blocks on etherscan.
Then check claimHash is indeed the expected one.
Context
Inphi (Optimism) confirmed and commented:
EV_om (warden) commented:
obront (judge) commented:
