Location: contracts/account_factory/src/test.rs (entire file — one #[test] fn)
Root cause / scenario:
test_batch_initialize_flow deploys the factory, calls initialize(), and constructs a Vec — but the function ends with a comment ('We can't fully test deployment from within a test like this... but we have verified the flow!') and a println!, without ever calling factory_client.batch_initialize(&creator, &requests) or asserting on any result.
Impact:
This is the only test file for the contract that contains both of the critical bugs above (unprotected initializer, salt collision). Neither bug is — or could be — caught by this suite as written, since the function under test is never actually invoked.
Suggested fix:
Write a real test that calls batch_initialize twice in sequence (to catch the salt-collision bug) and a separate test that calls initialize() twice from different callers (to catch the missing access-control bug), asserting on the actual AccountInitResult / error behavior rather than printing a success message.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 23/32).
Location:
contracts/account_factory/src/test.rs (entire file — one #[test] fn)Root cause / scenario:
test_batch_initialize_flow deploys the factory, calls initialize(), and constructs a Vec — but the function ends with a comment ('We can't fully test deployment from within a test like this... but we have verified the flow!') and a println!, without ever calling factory_client.batch_initialize(&creator, &requests) or asserting on any result.
Impact:
This is the only test file for the contract that contains both of the critical bugs above (unprotected initializer, salt collision). Neither bug is — or could be — caught by this suite as written, since the function under test is never actually invoked.
Suggested fix:
Write a real test that calls batch_initialize twice in sequence (to catch the salt-collision bug) and a separate test that calls initialize() twice from different callers (to catch the missing access-control bug), asserting on the actual AccountInitResult / error behavior rather than printing a success message.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 23/32).