Deploy script is trying to deploy to wrong chains

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-10-kleidi/blob/ab89bcb443249e1524496b694ddb19e298dca799/src/deploy/SystemDeploy.s.sol#L23-L26

Vulnerability details

Proof of Concept

In the README file, the protocol states that the system deployment will be deployed to Arbitrum, Ethereum Mainnet, Base, Optimism Mainnet.

Chains the protocol will be deployed on Arbitrum,Ethereum,Optimism,Base

In Kleidi protocol the deploy script is also in the scope in this contest. But the deploy script is using wrong chain id's in the constructor and deployment won't work on Optimism and Arbitrum.

    constructor() {
        uint256[] memory chainIds = new uint256[](4);
        chainIds[0] = 1; // @audit-info Mainnet
        chainIds[1] = 8453; // @audit-info Base
        chainIds[2] = 84532; // @audit-info Base Sepolia
        chainIds[3] = 11155420; // @audit-info Optimism Sepolia
        addresses = new Addresses("./addresses", chainIds);
    }

And the provided deployment command won't work in Optimism and Arbitrum.

/// DO_PRINT=false DO_BUILD=false DO_RUN=false DO_DEPLOY=true DO_VALIDATE=true forge script src/deploy/SystemDeploy.s.sol:SystemDeploy --fork-url base -vvvvv

Because in validation it will revert.

    function validate() public view override {
        if (addresses.isAddressSet("TIMELOCK_FACTORY")) {
            address factory = addresses.getAddress("TIMELOCK_FACTORY");
            assertEq(
                keccak256(factory.code),
                keccak256(type(TimelockFactory).runtimeCode),
                "Incorrect TimelockFactory Bytecode"
            );

            address guard = addresses.getAddress("GUARD");
            assertEq(
                keccak256(guard.code),
                keccak256(type(Guard).runtimeCode),
                "Incorrect Guard Bytecode"
            );

            address recoverySpellFactory =
                addresses.getAddress("RECOVERY_SPELL_FACTORY");
            assertEq(
                keccak256(recoverySpellFactory.code),
                keccak256(type(RecoverySpellFactory).runtimeCode),
                "Incorrect RecoverySpellFactory Bytecode"
            );

            /// cannot check bytecode, following error is thrown when trying:
            ///  `"runtimeCode" is not available for contracts containing
            ///   immutable variables.`
            InstanceDeployer deployer =
                InstanceDeployer(addresses.getAddress("INSTANCE_DEPLOYER"));

            assertEq(
                deployer.safeProxyFactory(),
                addresses.getAddress("SAFE_FACTORY"),
                "incorrect safe proxy factory"
            );
            assertEq(
                deployer.safeProxyLogic(),
                addresses.getAddress("SAFE_LOGIC"),
                "incorrect safe logic contract"
            );
            assertEq(
                deployer.timelockFactory(),
                addresses.getAddress("TIMELOCK_FACTORY"),
                "incorrect timelock factory"
            );
            assertEq(
                deployer.guard(),
                addresses.getAddress("GUARD"),
                "incorrect GUARD"
            );
            assertEq(
                deployer.multicall3(),
                addresses.getAddress("MULTICALL3"),
                "incorrect MULTICALL3"
            );
        }
    }

Recommended Mitigation Steps

Swap the correct chainIds with the wrong chainIds.

Assessed type

Context

[c4-judge]

GalloDaSballo changed the severity to QA (Quality Assurance)

[c4-judge]

GalloDaSballo marked the issue as grade-b