create2 about clone-factory

[BlinkyStitt]

If the factory contract used CREATE2, I think someone could front run a transaction's salt and steal the address. So you'd have to wait for a few confirmations before sending any funds.

[moodysalem]

If the factory contract used CREATE2, I think someone could front run a transaction's salt and steal the address. So you'd have to wait for a few confirmations before sending any funds.

Not true, CREATE2 uses the deployer address in computing the resulting contract address

edit: not sure exactly what situation you are describing

[BlinkyStitt]

But in this case, the deployer's address is the factory address, not msg.sender.

…

On Oct 8, 2020, at 3:06 PM, Moody Salem ***@***.***> wrote:  If the factory contract used CREATE2, I think someone could front run a transaction's salt and steal the address. So you'd have to wait for a few confirmations before sending any funds. Not true, CREATE2 uses the deployer address in computing the resulting contract address — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[moodysalem]

Oh, I am using a version of the minimal proxy in a library and calling it from a contract.

[ItsNickBarry]

@moodysalem I've published a create2 implementation here: https://github.com/solidstate-network/solidstate-contracts/blob/master/contracts/architecture/factory/MinimalProxyFactory.sol

Note that it's in a pre-release state, and not to be completely trusted. It is also likely to not be as minimal as possible. I still need to test the gas consumption.

[yarrumretep]

Hi guys, Can you submit a PR and we'll have the optionality team take a look at it? Best, pete

…

On Sun, Nov 22, 2020 at 6:13 PM Nick Barry ***@***.***> wrote: @moodysalem <https://github.com/moodysalem> I've published a create2 implementation here: https://github.com/solidstate-network/solidstate-contracts/blob/master/contracts/architecture/factory/MinimalProxyFactory.sol Note that it's in a pre-release state, and not to be completely trusted. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#18 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFRBO4Z5WW73TUMZEQDS6TSRGLI5ANCNFSM4SB5OP6Q> .

-- -pete peter m. murray [email protected]

[PaulRBerg]

If the factory contract used CREATE2, I think someone could front run a transaction's salt and steal the address.

I think that this issue could be circumvented by hashing the tx.origin with the user-provided salt, and passing the resultant hash as the salt to create2.

Note that it should be tx.origin rather than msg.sender because the issue would not otherwise be mitigated for factory contracts.

[PaulRBerg]

Looks like OpenZeppelin added support for CREAT2-enabled minimal proxies in their Clones.sol contract:

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/aefcb3e8aa4ee8da8e2b7022ffe4dcb57fbb0fdf/contracts/proxy/Clones.sol#L42-L51