Skip to content

feat: make _msgSender virtual across all base and factory contracts #704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anzzyspeaksgit wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: make _msgSender virtual across all base and factory contracts #704

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion contracts/base/ERC20Base.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ contract ERC20Base is ContractMetadata, Multicall, Ownable, ERC20Permit, IMintab
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC20Drop.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ contract ERC20Drop is ContractMetadata, Multicall, Ownable, ERC20Permit, Primary
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC20DropVote.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ contract ERC20DropVote is ContractMetadata, Multicall, Ownable, ERC20Votes, Prim
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC20Vote.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ contract ERC20Vote is ContractMetadata, Multicall, Ownable, ERC20Votes, IMintabl
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
Copy link

@coderabbitai coderabbitai bot Mar 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Unify sender source in burn now that _msgSender() is overridable.

With this change, derived contracts can override _msgSender(), but burn still mixes sender sources: it checks balanceOf(_msgSender()) (Line 63) and burns msg.sender (Line 64). That can revert incorrectly or burn against the wrong caller context in meta-transaction-style overrides.

Proposed fix 
 function burn(uint256 _amount) external virtual {
-    require(balanceOf(_msgSender()) >= _amount, "not enough balance");
-    _burn(msg.sender, _amount);
+    address sender = _msgSender();
+    require(balanceOf(sender) >= _amount, "not enough balance");
+    _burn(sender, _amount);
 }
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@contracts/base/ERC20Vote.sol` at line 108, The burn function mixes raw
msg.sender with the overridable _msgSender(), which can cause wrong-account
burns under meta-transaction overrides; update burn to consistently use
_msgSender() for both the balance check and the actual burn operation (ensure
calls to balanceOf(...) and the internal _burn(...) or transfer logic use
_msgSender()), so the sender source is unified with the overrideable
_msgSender() implementation.

return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC721Base.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ contract ERC721Base is ERC721AQueryable, ContractMetadata, Multicall, Ownable, R
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC721Drop.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,7 +306,7 @@ contract ERC721Drop is
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC721LazyMint.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ contract ERC721LazyMint is
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/base/ERC721Multiwrap.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,7 @@ contract ERC721Multiwrap is
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Context) returns (address) {
function _msgSender() internal view virtual override(Multicall, Context) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/infra/registry/entrypoint/TWMultichainRegistryRouter.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ contract TWMultichainRegistryRouter is PermissionsEnumerableLogic, ERC2771Contex
return hasRole(DEFAULT_ADMIN_ROLE, _msgSender());
}

function _msgSender() internal view override(ERC2771ContextLogic, PermissionsLogic, Multicall) returns (address) {
function _msgSender() internal view virtual override(ERC2771ContextLogic, PermissionsLogic, Multicall) returns (address) {
return ERC2771ContextLogic._msgSender();
}

Expand Down
2 changes: 1 addition & 1 deletion contracts/prebuilts/account/dynamic/DynamicAccountFactory.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ contract DynamicAccountFactory is BaseAccountFactory, ContractMetadata, Permissi
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Permissions) returns (address) {
function _msgSender() internal view virtual override(Multicall, Permissions) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/prebuilts/account/managed/ManagedAccountFactory.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ contract ManagedAccountFactory is BaseAccountFactory, ContractMetadata, Permissi
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Permissions) returns (address) {
function _msgSender() internal view virtual override(Multicall, Permissions) returns (address) {
return msg.sender;
}
}
2 changes: 1 addition & 1 deletion contracts/prebuilts/account/non-upgradeable/AccountFactory.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ contract AccountFactory is BaseAccountFactory, ContractMetadata, PermissionsEnum
}

/// @notice Returns the sender in the given execution context.
function _msgSender() internal view override(Multicall, Permissions) returns (address) {
function _msgSender() internal view virtual override(Multicall, Permissions) returns (address) {
return msg.sender;
}
}