global team, we have a problem with deploying Safe: The smart contract deployment of Safe uses create2 for deployment, which allows for the same address on all chains. The core issue is that a private key is utilized to sign a transaction intended to deploy a factory contract, which in turn is responsible for deploying other contracts. However, once this factory contract is live, it becomes possible for anyone with knowledge of its address to deploy additional contracts through it. This effectively nullifies our control over contract deployment permissions. Could you please suggest an appropriate solution to address this concern? Thank you!
2 Answers
Here are couple of solutions that i can think of
Multi-signature wallet Utilize a multi-signature wallet like Gnosis Safe. This allows you to configure a set of addresses (owners) required to approve any deployment through the factory contract. This way, no single private key can deploy malicious contracts.
Timed window Implement a time-locked mechanism on the factory contract. Set a specific timeframe (e.g., one week) after the initial deployment where additional deployments are allowed. This allows for initial deployments by authorized personnel while restricting future unauthorized use.
Permissioned access list Implement a whitelist on the factory contract. Only pre-authorized contract addresses can be deployed through the factory. This requires maintaining an access list and managing its updates securely.
answered Apr 24 at 7:34
yes this is a feature of smart contracts to have publicly accessible methods for anyone to interact with.
If this behaviour is a problem you could add modifiers for certain methods so that only a set of known addresses are able to use them.
Please let me know if this solves your problem.
Best, Louis
answered Apr 24 at 6:50
