Replay attack for deployHolographableContract()

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographFactory.sol#L192

Vulnerability details

Impact

Detailed description of the impact of this finding.
Function deployHolographableContract() is subject to reply attack since the signature does not sign chainid and address of the contract HolographFactory. As a result, the same signature can be replayed at another chain with another HolographFactory, leading to creating the contract to be created either before schedule or in the chain that is not planned.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographFactory.sol#L192

Tools Used

Manual

Recommended Mitigation Steps

To avoid reply attack, the signature must sign the chainid and the address of the HolographFactory contract as well.

[gzeoneth]

Related to #261 from the same warden, there actually is a chainType but not validated onchain.

[gzeoneth]

Although I don't see any problem for it to be replayed, the owner will still be the same EOA.

[alexanderattar]

Design decision. Deployment signature has chainId intentionally left out to be able to replay on other chains which is one of the core premises of the protocol