Location: contracts/account_factory/src/test.rs (single, assertion-free test) + contracts/sweep_controller/tests/integration.rs (constructs ephemeral accounts directly via env.register_contract, not via the factory) + contracts/ephemeral_account/src/test.rs (tests the contract in isolation)
Root cause / scenario:
Every existing test suite exercises exactly one contract at a time. sweep_controller's integration tests register an EphemeralAccountContract instance directly and initialize it by hand, bypassing account_factory entirely — meaning the hardcoded-controller bug (account_factory always passing creator as authorized_controller) is invisible to sweep_controller's test suite, since those tests construct accounts with whatever controller they choose.
Impact:
The single most security-relevant path in the whole system — a real deployment flow of AccountFactory.batch_initialize() followed by SweepController.claim() against one of the resulting accounts — has zero test coverage, and is exactly the path where the hardcoded-controller bug above would surface as a hard authorization failure in production.
Suggested fix:
Add an end-to-end integration test that deploys all three contracts, creates an account via account_factory (not by hand), funds it, and sweeps it via sweep_controller — this test would fail today given the hardcoded-controller bug, which is itself useful confirmation of that issue.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 31/32).
Location:
contracts/account_factory/src/test.rs (single, assertion-free test) + contracts/sweep_controller/tests/integration.rs (constructs ephemeral accounts directly via env.register_contract, not via the factory) + contracts/ephemeral_account/src/test.rs (tests the contract in isolation)Root cause / scenario:
Every existing test suite exercises exactly one contract at a time. sweep_controller's integration tests register an EphemeralAccountContract instance directly and initialize it by hand, bypassing account_factory entirely — meaning the hardcoded-controller bug (account_factory always passing creator as authorized_controller) is invisible to sweep_controller's test suite, since those tests construct accounts with whatever controller they choose.
Impact:
The single most security-relevant path in the whole system — a real deployment flow of AccountFactory.batch_initialize() followed by SweepController.claim() against one of the resulting accounts — has zero test coverage, and is exactly the path where the hardcoded-controller bug above would surface as a hard authorization failure in production.
Suggested fix:
Add an end-to-end integration test that deploys all three contracts, creates an account via account_factory (not by hand), funds it, and sweeps it via sweep_controller — this test would fail today given the hardcoded-controller bug, which is itself useful confirmation of that issue.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 31/32).