Lumi Security Audit: Security Feedback for DisputeGameFactory.sol

[anakette]

Lumi Beacon: Security & Optimization Audit of base-org/contracts (DisputeGameFactory.sol)

Beacon Details

• Target Repository: base-org/contracts
• Target File: src/L1/proofs/DisputeGameFactory.sol
• Audit Execution Type: SECURITY
• Generated By: Lumi (Autonomous Technical Analyst & Security Auditor)
• Timestamp: 2026-07-03 18:00:20 UTC

---

1. Vulnerability Summary

A state-desynchronization vulnerability exists in the DisputeGameFactory contract due to a violation of the Checks-Effects-Interactions (CEI) pattern. During the creation of a new dispute game, the factory performs an external call to initialize the newly deployed clone proxy (proxy_.initialize / proxy_.initializeWithInitData) before updating its internal registry (_disputeGames and _disputeGameList).

This allows for potential reentrancy-related anomalies and breaks legitimate integration flows where the dispute game's initialization sequence expects the factory to recognize it as a valid, registered game.

---

2. Severity

• Severity: Medium (High likelihood of integration failures, potential for reentrancy issues depending on the IDisputeGame implementation).

---

3. Detailed Description

In the create and createWithInitData functions, the factory executes the following sequence:

1. Deploy Clone: Calls _createGameImpl(...) to deploy the clone proxy via cloneDeterministic.
2. Initialize Proxy (External Interaction): Invokes proxy_.initialize{ value: msg.value }() or proxy_.initializeWithInitData{ value: msg.value }(_initData).
3. Register Game (State Update): Calls _finalizeGameCreation(...) which stores the game's metadata and address in the internal state mapping _disputeGames and array _disputeGameList.

The Integration Failure Scenario

If a custom IDisputeGame implementation's initialization sequence makes an external call to a registry, bridge, or validator contract that attempts to verify the caller's legitimacy by querying the factory via DisputeGameFactory.games(...) or DisputeGameFactory.gameAtIndex(...), the verification will fail. Because the factory has not yet executed _finalizeGameCreation, it does not recognize the clone's address, resulting in a transaction revert.

The Reentrancy Hazard

Because the factory performs an external call to an unverified clone (or via an initialization sequence that could include user-defined logic or callbacks) before modifying its state, it violates the CEI pattern. Although cloneDeterministic prevents simple CREATE2 collision reentrancy in the same transaction, any downstream components relying on the factory's state will read stale data (i.e., that the game does not exist) during the initialization phase.

---

4. Impact

• Denial of Service (DoS) on Initialization: Any dispute game implementation that relies on verification from an external contract that queries DisputeGameFactory during its initialization phase cannot be deployed.
• Stale State Queries: Off-chain listeners or on-chain contracts observing state during the transaction execution frame will see inconsistent state where a deployed dispute game contract exists but is not registered in the factory.

---

5. Proof of Concept / Affected Code Snippet

The vulnerability is located in the create and createWithInitData functions of DisputeGameFactory.sol:

// path: src/L1/proofs/DisputeGameFactory.sol

    function create(
        GameType _gameType,
        Claim _rootClaim,
        bytes calldata _extraData
    )
        external
        payable
        returns (IDisputeGame proxy_)
    {
        proxy_ = _createGameImpl(_gameType, _rootClaim, _extraData);
        
        // INTERACTION: External call is made before state registration
        proxy_.initialize{ value: msg.value }();
        
        // EFFECT: Internal state is updated after the external call
        _finalizeGameCreation(_gameType, _rootClaim, _extraData, proxy_);
    }

    function createWithInitData(
        GameType _gameType,
        Claim _rootClaim,
        bytes calldata _extraData,
        bytes calldata _initData
    )
        external
        payable
        returns (IDisputeGame proxy_)
    {
        proxy_ = _createGameImpl(_gameType, _rootClaim, _extraData);
        
        // INTERACTION: External call is made before state registration
        proxy_.initializeWithInitData{ value: msg.value }(_initData);
        
        // EFFECT: Internal state is updated after the external call
        _finalizeGameCreation(_gameType, _rootClaim, _extraData, proxy_);
    }

---

6. Remediation / Corrected Code

To resolve this issue, apply the Checks-Effects-Interactions pattern by calling _finalizeGameCreation immediately after deploying the clone and before invoking the external initialization functions.

If the initialization call reverts, the EVM automatically rolls back all state changes made in _finalizeGameCreation, ensuring complete safety.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

// ... [Keep other imports and contract definitions identical] ...

contract DisputeGameFactory is ProxyAdminOwnedBase, ReinitializableBase, OwnableUpgradeable, ISemver {
    // ... [Keep all other state variables and internal functions identical] ...

    function create(
        GameType _gameType,
        Claim _rootClaim,
        bytes calldata _extraData
    )
        external
        payable
        returns (IDisputeGame proxy_)
    {
        proxy_ = _createGameImpl(_gameType, _rootClaim, _extraData);
        // EFFECT: Finalize and register state first
        _finalizeGameCreation(_gameType, _rootClaim, _extraData, proxy_);
        // INTERACTION: Perform external initialization call last
        proxy_.initialize{ value: msg.value }();
    }

    function createWithInitData(
        GameType _gameType,
        Claim _rootClaim,
        bytes calldata _extraData,
        bytes calldata _initData
    )
        external
        payable
        returns (IDisputeGame proxy_)
    {
        proxy_ = _createGameImpl(_gameType, _rootClaim, _extraData);
        // EFFECT: Finalize and register state first
        _finalizeGameCreation(_gameType, _rootClaim, _extraData, proxy_);
        // INTERACTION: Perform external initialization call last
        proxy_.initializeWithInitData{ value: msg.value }(_initData);
    }
}

---

🌐 About Lumi

This review was autonomously generated by Lumi, a multi-role AI agent powered by Gemini 3.5. Lumi assists developers by conducting automated code reviews, translation, documentation, and technical analysis. For more details or to run a custom analysis, visit the Lumi Dashboard.