Skip to content

docs: drop the occupant-identity claim from CloneAddressOccupied - #261

Open
thedavidmeister wants to merge 2 commits into
mainfrom
2026-09-21-issue-119-occupied-error-scope
Open

thedavidmeister wants to merge 2 commits into
mainfrom
2026-09-21-issue-119-occupied-error-scope

Conversation

@thedavidmeister

Copy link
Copy Markdown
Contributor

Closes #119

CloneAddressOccupied's NatSpec named the occupant: on the open-salt path "the
exact clone asked for", on the namespaced path "the clone the same deployer
deployed at that salt". That identification only holds when the LIBRARY threw
the error. cloneAndInitialize bubbles the clone's revert data byte for byte
(src/lib/LibICloneableFactoryV4.sol:185-189) and the error is declared at file
scope, so it is in every factory's ABI: an implementation whose initialize
does revert CloneAddressOccupied(attacker) produces revert data the call site
cannot tell from the library's own throw, and a caller that believed the NatSpec
would treat an attacker-chosen address as "the clone".

The fix is the deletion. What is true at the one site that throws it is the
first sentence, which stays: the clone address already has code.

No edit to src/interface/ICloneableFactoryV4.sol. Its occupancy passage is
already scoped to a non-zero code size the CALLER reads, not to this error, and
that file belongs to a separate batch.

QA

  • Discriminating tests: n/a — a comment deletion with no executable change.
    Tests never assert NatSpec text.
  • Mutations applied: n/a — nothing executable moved. The whole suite is
    green on this branch (78 passed, 0 failed) as the merge check.
  • Oracle: src/lib/LibICloneableFactoryV4.sol:185-189, which bubbles
    returnData verbatim under a returnData.length > 0 guard only, and the
    file-scope error declarations at :12-31, which put all five selectors in the
    ABI of every factory built on the library.
  • Category check: the category is "an error's NatSpec asserting something
    that is only true when the library authored the revert". All five errors in
    the file were read. ZeroImplementationCodeSize, DelegatedImplementation
    and CloneDeploymentFailed state only the condition the library checks, which
    is all their throw sites claim; InitializationFailed states its condition
    plus the verbatim bubbling itself, which is the mechanism, not an inference
    from it. CloneAddressOccupied was the only one inferring an identity — who
    the occupant is and what data deployed it — from the mere fact of the revert.

🤖 Generated with Claude Code

thedavidmeister and others added 2 commits September 21, 2026 11:24
The error is declared at file scope, so it is in every factory's ABI, and
`cloneAndInitialize` bubbles a failing `initialize`'s revert data verbatim.
A caller cannot tell the library's own throw from one a clone authored, so
neither the selector nor the `clone` it carries identifies the occupant of
anything.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@thedavidmeister thedavidmeister self-assigned this Sep 21, 2026
@coderabbitai

coderabbitai Bot commented Sep 21, 2026

Copy link
Copy Markdown

Warning

Review limit reached

Next included review available in 29 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d8f418d1-3544-44fa-ae14-a610288ebc4b

📥 Commits

Reviewing files that changed from the base of the PR and between f2d9e5a and 8fb15f5.

📒 Files selected for processing (1)
  • src/lib/LibICloneableFactoryV4.sol

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant