QA-12: Order Assumption in get_account_base_nonces Can Misassign Nonces

monad-qa-12-order-assumption-nonces

Summary

The nonce-fetching logic deduplicates addresses through a HashSet, then zips backend results back to addresses by position even though the trait contract does not guarantee output ordering.

Vulnerability details

1
let addresses = addresses.unique().collect::<HashSet<&'a Address>>();
2
// ...
3
let cache_miss_statuses = self.get_account_statuses(
4
    state_backend,
5
    &Some(extending_blocks),
6
    cache_misses.iter().map(|(address, _)| *address),
7
    &base_seq_num,
8
)?;
9

10
account_nonces.extend(cache_misses.into_iter().zip_eq(cache_miss_statuses).map(
11
    |((address, possible_nonces), status)| {
12
        let nonce = status.map_or(0, |status| status.nonce);
13
        (address, possible_nonces.map_or(nonce, |possible_nonces| {
14
            NonceUsage::apply_possible_nonces_to_account_nonce(nonce, possible_nonces)
15
        }))
16
    },
17
));

Impact

A backend that returns results in a different order could silently assign wrong nonces to wrong addresses and create inconsistent block validation outcomes.

Recommendation

Bind returned values to addresses explicitly or document and enforce ordering at the trait level.