Skip to content

Misleading NatSpec Comments in Deployment Contracts #330

@rya-sge

Description

@rya-sge

Version affected: v3.0.0
Deployment version: Debt, Light
Severity: Informational
Fix: v3.1.0
Reported by: Nethermind Audit Agent

The NatSpec documentation for the constructors of several deployment contracts ( CMTATStandaloneDebt ,
CMTATUpgradeableDebt , CMTATStandaloneLight , CMTATUpgradeableLight ) incorrectly states that they accept a forwarderIrrevocable parameter for ERC2771 meta-transaction support.

However, the actual contract implementations do not inherit the ERC2771Module , their constructors do not accept this parameter, and they do not provide gasless transaction functionality.

This discrepancy between the documentation and the implementation is misleading for developers and users of
the framework, who might incorrectly assume that these specific token configurations support meta-transactions.
While this does not introduce a direct code vulnerability, it represents a significant documentation flaw that can
lead to integration errors and incorrect assumptions about the contracts' capabilities.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Next releaseThe issue has been merged into dev and will be part of the next releasedocumentationImprovements or additions to documentation

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions