deth_ctf - Incorrect address computation

[Maroutis]

Summary

The computeAddress function does not compute the correct address for the would be deployed Vault.

Details

When a contract has constructor parameters, the Create2 opcode needs to account for the parameters that are to be concatenated with the contract's bytecode. In case of the Vault contract the owner parameter is missing and the initCode is incomplete :

    function computeAddress() public view returns (address) {
        bytes32 salt = bytes32(uint256(uint160(msg.sender)));
        return address(uint160(uint256(keccak256(abi.encodePacked(
            bytes1(0xff),
            address(this),
            salt,
 @>           keccak256(type(Vault).creationCode)
        )))));

Impact

Users will call the incorrect address where the call would ultimately fail or worse call a malicious contract where their funds could be at risk. In any case a non dev user will find himself stuck as he cannot use the computed address.

Solution

Implement the following changes :

    function computeAddress() public view returns (address) {
        bytes32 salt = bytes32(uint256(uint160(msg.sender)));
        return address(uint160(uint256(keccak256(abi.encodePacked(
            bytes1(0xff),
            address(this),
            salt,
            keccak256(abi.encodePacked(type(Vault).creationCode, abi.encode(msg.sender))
        ))))));

[0xdeth]

Duplicate of #6.