ConsensusApp Deployed for Both Margin AND Escrow Channels (EscrowApp.sol never deployed) #537

ConsensusApp Deployed for Both Margin AND Escrow Channels

Type: Deployment Misconfiguration
Status: Confirmed via source code + on-chain bytecode verification

Location (Source Code):

• scripts/deployClearsync.ts (Lines 86-87)
  https://github.com/layer-3/clearsync/blob/master/scripts/deployClearsync.ts
• contracts/clearing/EscrowApp.sol (contains proper swap logic, NEVER deployed)
  https://github.com/layer-3/clearsync/blob/master/contracts/clearing/EscrowApp.sol

Deployed On-Chain (Polygon):

• Margin App: 0xd3f6EA0DCe26E7836fB309dcfcf506e44524B2A5 (ConsensusApp)
• Escrow App: 0x59735037AC294641F8CE51d68D6C45a500B8e645 (ConsensusApp — SAME)
• Bytecode verified: IDENTICAL (2338 bytes each)

Description:

The deployment script deploys ConsensusApp.sol for BOTH the Margin channel and the Escrow channel, but EscrowApp.sol — which contains proper swap verification logic — was never deployed. The TODO comments at lines 86-87 were never resolved:

const EscrowApp = await EscrowAppFactory.connect(deployer).deploy(gasOverrides);
// TODO: change with EscrowApp when ready

Both lines use the ConsensusApp factory. Both deployed contracts have identical bytecode on-chain.

Impact:

EscrowApp.sol contains _requireAllocationSwapped() which validates that asset destinations actually swap between participants. Without this check, ConsensusApp only validates unanimous signatures and total amount unchanged — escrow settlements can be finalized without proper asset redistribution.

Scenario:

• Alice deposits 100 USDT, Bob deposits 100 USDT into Escrow channel
• They agree on settlement: Alice gets 150, Bob gets 50
• Bob submits a DIFFERENT state: Alice gets 50, Bob gets 150 (same total, swapped)
• ConsensusApp: both signed + total unchanged = PASS
• EscrowApp (if deployed): destinations didn't actually swap = FAIL

Recommended Fix:

1. Deploy the proper EscrowApp.sol contract
2. Update the Escrow App proxy to point to the correct implementation
3. Resolve the TODOs in deployClearsync.ts
4. Audit all chains where Escrow App is deployed

Contact:

Telegram @semfck