Location: contracts/account_factory/src/lib.rs:78-82
Root cause / scenario:
Err(_) => AccountInitResult { account_address: account_address.clone(), success: false, error: None, // In a real implementation, we'd serialize errors } — the code's own comment acknowledges the actual error is thrown away.
Impact:
Combined with the salt-collision bug above, every failed deployment after the first successful batch_initialize call will report success: false with no indication of why — an integrator has no way to distinguish 'ran out of gas', 'expiry_ledger was invalid', and 'this address was already deployed to' from the returned AccountInitResult alone.
Suggested fix:
Serialize the actual error (e.g. as a Bytes-encoded error code or message) into the error field rather than always returning None, especially important once the salt-collision root cause is fixed and rarer, harder-to-diagnose failures become the dominant failure mode.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 25/32).
Location:
contracts/account_factory/src/lib.rs:78-82Root cause / scenario:
Err(_) => AccountInitResult { account_address: account_address.clone(), success: false, error: None, // In a real implementation, we'd serialize errors } — the code's own comment acknowledges the actual error is thrown away.
Impact:
Combined with the salt-collision bug above, every failed deployment after the first successful batch_initialize call will report success: false with no indication of why — an integrator has no way to distinguish 'ran out of gas', 'expiry_ledger was invalid', and 'this address was already deployed to' from the returned AccountInitResult alone.
Suggested fix:
Serialize the actual error (e.g. as a Bytes-encoded error code or message) into the error field rather than always returning None, especially important once the salt-collision root cause is fixed and rarer, harder-to-diagnose failures become the dominant failure mode.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 25/32).