deployHolographableContract() uniqueness

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographFactory.sol#L206-L215

Vulnerability details

Impact

The holographable smart contract deployment can not guarantee the uniqueness. A malicious user could deploy multiple duplicate contracts, then the brigeIn could not make sure the uniqueness of the minted or burned NFT.

Proof of Concept

The salt and initCode could be changed and generate different hash.

// contracts/HolographFactory.sol
    bytes32 hash = keccak256(
      abi.encodePacked(
        config.contractType,
        config.chainType,
        config.salt,
        keccak256(config.byteCode),
        keccak256(config.initCode),
        signer
      )
    );

Tools Used

Manual analysis.

Recommended Mitigation Steps

Do not include salt and initCode in the hash.

[gzeoneth]

As you said, they would be different contract and whatever interact with them should verify the address.

[alexanderattar]

Seconding the above