008.md

Teeny Foggy Gecko

Medium

Wrong argument used in deploying the StreamEscrow smart contract

Summary

Description + Impact

.s.sol files are scripts we are going to use as part of the deployment and upgrade on mainnet, so they are in scope in case there are any issues there was sent in the discord channel by one of the sponsors so these vulnerabilities are in scope. Will be marked as medium only because of the sponsor's statement even if it can very easily be mitigated.

https://github.com/sherlock-audit/2024-11-nounsdao/blob/main/nouns-monorepo/packages/nouns-contracts/script/StreamEscrow/DeployAuctionHouseV3StreamEscrowBase.s.sol#L12-L41

DeployAuctionHouseV3StreamEscrowBase.s.sol :: runInternal() is used to deploy the new version of the protocol that supports the StreamEscrow functionalities.

NounsAuctionHouseV3 is a fork of NounsAuctionHouseV2 that integrates the StreamEscrow functionalities.

StreamEscrow smart contract wrongly is deployed with streamCreator_ argument as the already deployed NounsAuctionHouseV2 instead of NounsAuctionHouseV3 that is meant to be used in combination with StreamEscrow smart contract.

streamCreator_ argument is used in the allowedToCreateStream state variable. StreamEscrow :: createStream() uses allowedToCreateStream state variable as access control. NounsAuctionHouseV3 is the obvious address to be set as true in allowedToCreateStream, even if it can easily mitigated by executing StreamEscrow :: setAllowedToCreateStream() after deployment.

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

PoC

There is no need for a coded PoC for this issue.

Mitigation

No response