coral-xyz/sealevel-attacks

Misleading secure example for 4-initialization

oslfmt opened this issue · 0 comments

I believe there are couple issues with the secure example for 4-initialization attack.

  1. The discriminator field in the User struct is a misleading field name. It is not used in the code as a discriminator, in the sense that type-cosplay calls for, ie, to uniquely differentiate accounts. Further, a bool cannot even be used as a proper discriminant. It seems like the field should be renamed to is_initialized, because that is what it seems like it is being used for, an initialization flag.
  2. If the purpose of the discriminator field is indeed intended to be used as an "initialization flag", there should not be a boolean NOT operator on line 13. If user.discriminator is false, ie, uninitialized, then it should be initialized. However, the logic dictates that if it is false, then the code returns an error. If it is true (initialized), then it is reinitialized. This is the opposite of what we want I believe.