Location: contracts/shared/src/types.rs:37-41
Root cause / scenario:
AccountInitRequest { expiry_ledger: u32, recovery_address: Address } — this is the shared data contract between account_factory and its callers. There is structurally no way to request a different authorized_controller or admin per account through this type.
Impact:
This is the root cause of the critical hardcoded-controller bug found in account_factory::batch_initialize; fixing that function alone isn't possible without first extending this shared struct, since the fields simply don't exist yet.
Suggested fix:
Extend AccountInitRequest with authorized_controller: Address (and optionally admin: Address, or default it to a fixed system-wide upgrade-admin instead of exposing it per-request) as part of the same change that fixes the account_factory hardcoding issue.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 30/32).
Location:
contracts/shared/src/types.rs:37-41Root cause / scenario:
AccountInitRequest { expiry_ledger: u32, recovery_address: Address } — this is the shared data contract between account_factory and its callers. There is structurally no way to request a different authorized_controller or admin per account through this type.
Impact:
This is the root cause of the critical hardcoded-controller bug found in account_factory::batch_initialize; fixing that function alone isn't possible without first extending this shared struct, since the fields simply don't exist yet.
Suggested fix:
Extend AccountInitRequest with authorized_controller: Address (and optionally admin: Address, or default it to a fixed system-wide upgrade-admin instead of exposing it per-request) as part of the same change that fixes the account_factory hardcoding issue.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 30/32).