Skip to content

C4 S-80 Add multicall3 deployment#86

Closed
ScreamingHawk wants to merge 2 commits intomainfrom
multicall3
Closed

C4 S-80 Add multicall3 deployment#86
ScreamingHawk wants to merge 2 commits intomainfrom
multicall3

Conversation

@ScreamingHawk
Copy link
Contributor

S-80 Multicall3 address mismatch on Sophon enables delegatecall hijack and complete wallet drain

https://code4rena.com/audits/2025-11-sequence-transaction-rails/submissions/S-80

Issue: Multicall3 is not available on all chains.

Analysis: As per the Multicall3 repo, Multicall3 can be deployed at 0xcA11bde05977b3631167028862bE2a173976CA11 via a presigned transaction. Most chains have this deployed already, however new chains may not have it available.

Fix: Adds the presigned deployment of multicall3 as a dependency of Trails jobs.

NOTE: This PR depends on 0xsequence/catapult#13 and requires a catapult version update before merging, as the skip_condition is not being detected at the job level.

@ScreamingHawk ScreamingHawk changed the title S-80 Add multicall3 deployment C4 S-80 Add multicall3 deployment Nov 25, 2025
@Agusx1211
Copy link
Member

deployed @0xsequence/catapult@1.3.11 with the patch applied

@ScreamingHawk ScreamingHawk marked this pull request as ready for review November 25, 2025 18:44
@ScreamingHawk ScreamingHawk requested a review from a team as a code owner November 25, 2025 18:44
@ScreamingHawk ScreamingHawk marked this pull request as draft November 25, 2025 19:34
@ScreamingHawk
Copy link
Contributor Author

Converting to draft while I check the failing tests. Multicall3 deployment may be blocked on some of our supported chains.

@ScreamingHawk
Copy link
Contributor Author

  • Homeverse testnet: Multicall3 deployer is not approved for deployments. We need to contact their team. Mainnet already deployed.
  • Skale testnet: Error unrelated
  • Somnia testnet: DEPLOYMENT BLOCKED! Nonce is already used for the deployer EOA
  • Somnia mainnet: ^
  • Xai sepolia: ^. Mainnet already deployed
  • Telos testnet: Error unrelated

@ScreamingHawk
Copy link
Contributor Author

Closing this. We are not going to do the canonical MultiCall3 deployment with pre-signed transactions

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants