docs: the open-salt address fixes the implementation's address, not its code

[thedavidmeister]

Closes #107

The open-salt front-running argument closed with "It is a property of this
signature, not a condition on the implementation being cloned, so there is no
per-implementation audit of 'could a squatter pass something worse' to get
wrong." The derivation hashes keccak256(cloneCreationCode(implementation)),
and the EIP-1167 creation code embeds the implementation's ADDRESS — so the
address commits to where the clone delegates, never to what runs there. An
implementation that delegates onward to a target it can reach from its own code
(a beacon proxy, whose beacon is an immutable and so survives the clone's
delegatecall context) leaves the clone's behaviour with whoever retargets the
beacon: a front-runner picks WHICH logic gets pinned, and the clone's behaviour
stays third-party-controlled forever after. checkImplementationCode screens
only zero code size and the 0xef EIP-7702 designator and cannot see this, and
the "What the address does NOT fix, which implementations MUST respect" list
enumerated only tx.origin, forwarded gas and chain-state resolution.

Per owner ruling, fixed by scoping the claim, not by adding a guard.

• ICloneableFactoryV4.cloneDeterministicOpenSalt: the closing claim now says
  what the signature does commit (what a squatter can PASS) and that it commits
  neither the implementation's code nor anything else initialize reads.
• Same NatSpec: "they do not" -> "they cannot vary it", since data is the only
  thing the derivation takes off the table.
• One MUST added to the list: the implementation MUST NOT delegate onward to a
  target anyone can change.
• LibICloneableFactoryV4.DelegatedImplementation: notes that the 0xef form
  is the only mutable-code shape detectable there.

A second commit cuts the section's padding: the Zoltu analogy, the narration of
what each front-running case costs, and the data MAY be empty bullet the
@param already carries.

Comment-only. No src behaviour changes.

QA

• Discriminating tests: n/a — NatSpec only, no behaviour to discriminate, and
  tests never assert comment text.
• Mutations applied: n/a — no executable line changed; mutation-probe has
  nothing to mutate in a comment.
• Oracle: the code itself. LibICloneableFactoryV4.cloneCreationCode
  (EIP1167_CREATION_CODE_PREFIX ++ implementation ++ SUFFIX) and
  predictCloneAddress (keccak256(0xff ++ factory ++ derivedSalt ++ keccak256(creationCode))) fix the implementation address in the derivation;
  checkImplementationCode rejects only zero code size and a leading 0xef.
  grep -rniE "immutab|proxy|beacon|upgrad" src/ finds no other statement of an
  implementation-immutability requirement.
• Category check: the category is "the interface asserts a property the
  derivation does not actually fix". The other live instance,
  predictDeterministicAddressOpenSalt's "what occupies it is the clone that
  was asked for", stays as written: it is true — an EIP-1167 proxy to the
  requested implementation, initialized with the requested data, is what
  occupies the address. What is not fixed is what that implementation runs,
  which the new MUST states once, in the same NatSpec block.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 11 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f19c2002-0c12-414d-9c90-0ef81c8d8fce

📥 Commits

Reviewing files that changed from the base of the PR and between 4986bfb and c9a87c1.

📒 Files selected for processing (2)

• src/interface/ICloneableFactoryV4.sol
• src/lib/LibICloneableFactoryV4.sol

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}