fix: cache the deployer to mitigate front-running on initialization (#148)

Author: RahulMaganti47

evm/src/Manager.sol

@@ -36,8 +36,10 @@ abstract contract Manager is
 
     error RefundFailed(uint256 refundAmount);
     error CannotRenounceManagerOwnership(address owner);
+    error UnexpectedOwner(address expectedOwner, address owner);
 
     address public immutable token;
+    address public immutable deployer;
     Mode public immutable mode;
     uint16 public immutable chainId;
     uint256 public immutable evmChainId;
@@ -104,9 +106,15 @@ abstract contract Manager is
         mode = _mode;
         chainId = _chainId;
         evmChainId = block.chainid;
+        // save the deployer (check this on iniitialization)
+        deployer = msg.sender;
     }
 
     function __Manager_init() internal onlyInitializing {
+        // check if the owner is the deployer of this contract
+        if (msg.sender != deployer) {
+            revert UnexpectedOwner(deployer, msg.sender);
+        }
         // TODO: msg.sender may not be the right address for both
         __PausedOwnable_init(msg.sender, msg.sender);
         // TODO: check if it's safe to not initialise reentrancy guard

evm/test/Upgrades.t.sol

@@ -672,23 +672,22 @@ contract TestInitialize is Test {
         managerChain1.initialize();
     }
 
-    // TODO - Keep or remove depending on frontrunning discussion for deployment
-    // function test_frontrunInitialize() public{
-    //     string memory url = "https://ethereum-goerli.publicnode.com";
-    //     vm.createSelectFork(url);
-
-    //     vm.chainId(chainId1);
-    //     DummyToken t1 = new DummyToken();
-    //     ManagerStandalone implementation =
-    //         new ManagerStandalone(address(t1), Manager.Mode.LOCKING, chainId1, 1 days);
-
-    //     managerChain1 = ManagerStandalone(address(new ERC1967Proxy(address(implementation), "")));
+    function test_cannotFrontrunInitialize() public {
+        string memory url = "https://ethereum-goerli.publicnode.com";
+        vm.createSelectFork(url);
 
-    //     vm.prank(userA);
+        vm.chainId(chainId1);
+        DummyToken t1 = new DummyToken();
+        ManagerStandalone implementation =
+            new ManagerStandalone(address(t1), Manager.Mode.LOCKING, chainId1, 1 days);
 
-    //     // Frontrun of initialization occurs HERE
-    //     managerChain1.initialize();
+        managerChain1 = ManagerStandalone(address(new ERC1967Proxy(address(implementation), "")));
 
-    //     require(address(this) == managerChain1.owner(), "Unexpected owner");
-    // }
+        // Attempt to initialize the contract from a non-deployer account.
+        vm.prank(userA);
+        vm.expectRevert(
+            abi.encodeWithSignature("UnexpectedOwner(address,address)", address(this), userA)
+        );
+        managerChain1.initialize();
+    }
 }