#28 - Ensure _execute and _tryExecute Functions Correctly Handle Calls to EOAs

[Aboudjem]

Updated _execute and _tryExecute functions to include an extcodesize check, ensuring calls to EOAs are not incorrectly marked as successful. This change aligns the behavior of low-level calls with Solidity's expectations

[github-actions]

Changes to gas cost

Generated at commit: c654f5061ba8ac118b20169a31f048db9ef0d8ea, compared to commit: 9c2537deb0d2d8dd3f724186df2ab700193eaa26

🧾 Summary (5% most significant diffs)

Contract	Method	Avg (+/-)	%
Nexus	execute executeFromExecutor	+176 ❌ +982 ❌	+0.36% +4.96%

---

Full diff report 👇

Contract	Deployment Cost (+/-)	Method	Min (+/-)	%	Avg (+/-)	%	Median (+/-)	%	Max (+/-)	%	# Calls (+/-)
Nexus	5,480,373 (+14,715)	execute executeFromExecutor	6,356 (+156) 14,719 (+190)	+2.52% +1.31%	49,150 (+176) 20,785 (+982)	+0.36% +4.96%	38,056 (+156) 20,699 (+1,089)	+0.41% +5.55%	143,098 (+120) 27,025 (+1,560)	+0.08% +6.13%	76 (0) 4 (0)

[openzeppelin-code]

refactor: Improve error handling in ExecutionHelper contract

Generated at commit: 0734b81b3272441e3385c33b8af9663351de94cd

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	0 1 0 6 24 31

---

For more details view the full report in OpenZeppelin Code Inspector

[github-actions]

🤖 Slither Analysis Report 🔎

Slither report

# Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• constable-states (2 results) (Optimization)

constable-states

Impact: Optimization
🔴 Confidence: High

• ID-0
  RegistryAdapter.registry should be constant

base/RegistryAdapter.sol#L12

• ID-1
  RegistryFactory.threshold should be constant

factory/RegistryFactory.sol#L39

_This comment was automatically generated by the GitHub Actions workflow._

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 13 lines in your changes missing coverage. Please review.

Project coverage is 71.68%. Comparing base (9c2537d) to head (0734b81).
Report is 46 commits behind head on remediations/cantina-spearbit.

Files	Patch %	Lines
contracts/base/ExecutionHelper.sol	0.00%	13 Missing ⚠️

Additional details and impacted files

@@                        Coverage Diff                        @@
##           remediations/cantina-spearbit     #128      +/-   ##
=================================================================
- Coverage                          72.54%   71.68%   -0.87%     
=================================================================
  Files                                 13       13              
  Lines                                663      671       +8     
  Branches                             151      154       +3     
=================================================================
  Hits                                 481      481              
- Misses                               182      190       +8     

Files	Coverage Δ
contracts/base/ExecutionHelper.sol	48.03% <0.00%> (-4.09%)	⬇️

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9c2537d...0734b81. Read the comment docs.

[livingrockrises]

success would already be 0 if it doesn't go to previous block.

[livingrockrises]

then it will still do this for EOA

success := call(gas(), target, value, result, callData.length, codesize(), 0x00)

[livingrockrises]

ensuring calls to EOAs are not incorrectly marked as successful.

I notice in case of eoa you're just doing this

mstore(result, 0) // Set result length to 0
mstore(0x40, add(result, 0x20)) // Update free memory pointer

but the other code following can still be executed.

Can you bring auditers attention to this comment again please?

a. Assume all calls to EOA invalid / unsuccessfull
b. sucessfull if it's just value transfer > 0 and calldata is 0x

Ensure it returns in such cases and does not go to other control paths.

Write appropriate tests for it

[livingrockrises]

@Aboudjem

[livingrockrises]

inclined to close this.