Location: contracts/ephemeral_account/src/errors.rs:1-16, contracts/sweep_controller/src/errors.rs:1-12, contracts/reserve_contract/src/errors.rs:1-30 (all start their own numbering at or near 1)
Root cause / scenario:
Each of the three (of four; account_factory has no dedicated errors.rs) contracts with typed errors defines its own #[repr(u32)] enum starting near 1, with heavy numeric overlap between them (e.g. value 1 means AlreadyInitialized in one contract, InvalidAccount in another, InvalidAmount in a third).
Impact:
Any shared client SDK, relayer, or monitoring dashboard that surfaces a raw numeric error code without also tracking which of the four contracts produced it risks displaying the wrong human-readable message to an operator during an incident.
Suggested fix:
Consider namespacing error codes per contract (e.g. offsetting each contract's range by a fixed block of 1000) or ensuring every piece of tooling that surfaces these errors always pairs the code with its originating contract ID, never just the bare number.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 29/32).
Location:
contracts/ephemeral_account/src/errors.rs:1-16, contracts/sweep_controller/src/errors.rs:1-12, contracts/reserve_contract/src/errors.rs:1-30 (all start their own numbering at or near 1)Root cause / scenario:
Each of the three (of four; account_factory has no dedicated errors.rs) contracts with typed errors defines its own #[repr(u32)] enum starting near 1, with heavy numeric overlap between them (e.g. value 1 means AlreadyInitialized in one contract, InvalidAccount in another, InvalidAmount in a third).
Impact:
Any shared client SDK, relayer, or monitoring dashboard that surfaces a raw numeric error code without also tracking which of the four contracts produced it risks displaying the wrong human-readable message to an operator during an incident.
Suggested fix:
Consider namespacing error codes per contract (e.g. offsetting each contract's range by a fixed block of 1000) or ensuring every piece of tooling that surfaces these errors always pairs the code with its originating contract ID, never just the bare number.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 29/32).