Location: docs/api-reference.md, docs/architecture.md (not fully reviewed in this pass)
Root cause / scenario:
This audit focused on contracts/ and cross-referenced docs/security.md and docs/reentrancy-analysis.md specifically, since those are the two documents making explicit security claims. api-reference.md and architecture.md were not line-by-line diffed against the actual account_factory and sweep_controller behavior found above.
Impact:
Given how significant the divergence between documented behavior and actual code was in the two docs that were checked (stale 'transfers not implemented' claim, undocumented claim() path), it's reasonably likely the remaining two docs describe batch_initialize and the nonce/destination-locking guarantee in terms that don't match the bugs found here either.
Suggested fix:
Do a follow-up pass on docs/api-reference.md and docs/architecture.md once the account_factory salt-collision and sweep_controller nonce-bypass issues are fixed, to make sure the corrected behavior (not the current buggy behavior) is what gets documented.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 32/32).
Location:
docs/api-reference.md, docs/architecture.md (not fully reviewed in this pass)Root cause / scenario:
This audit focused on contracts/ and cross-referenced docs/security.md and docs/reentrancy-analysis.md specifically, since those are the two documents making explicit security claims. api-reference.md and architecture.md were not line-by-line diffed against the actual account_factory and sweep_controller behavior found above.
Impact:
Given how significant the divergence between documented behavior and actual code was in the two docs that were checked (stale 'transfers not implemented' claim, undocumented claim() path), it's reasonably likely the remaining two docs describe batch_initialize and the nonce/destination-locking guarantee in terms that don't match the bugs found here either.
Suggested fix:
Do a follow-up pass on docs/api-reference.md and docs/architecture.md once the account_factory salt-collision and sweep_controller nonce-bypass issues are fixed, to make sure the corrected behavior (not the current buggy behavior) is what gets documented.
Found by reading the contract source directly and cross-checking docs/security.md and docs/reentrancy-analysis.md (item 32/32).