Description

Deploy scripts make use of cast block latest instead of cast block finalised to obtain relevant block and timing information. This may lead to unintended deployment parameters if a block is not finalized, parameters are stored, and a reorg happens before the code is considered deployed. Misconfigurations to timing variables may cause issues in the L2OutputOracle, a critical contract that is responsible for the integrity of transfers through the bridge.

Impact

The L2OutputOracle relies on startingTimestamp and startingBlockNumber, which may be set before the current timestamp if reorgs happen during deployment.

Recommendations

Consider using cast block finalised to ensure reorgs do not impact deployment.

Remediation

This issue has been acknowledged by Facet Protocol, and a fix was implemented in commit 89ebb6e6↗.