Add warning about Clones pointing to implementation with no code (#5798)

Co-authored-by: Ernesto García <[email protected]>
Signed-off-by: Hadrien Croubois <[email protected]>

Author: Amxx

contracts/proxy/Clones.sol

@@ -24,6 +24,10 @@ library Clones {
      * @dev Deploys and returns the address of a clone that mimics the behavior of `implementation`.
      *
      * This function uses the create opcode, which should never revert.
+     *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
      */
     function clone(address implementation) internal returns (address instance) {
         return clone(implementation, 0);
@@ -33,6 +37,10 @@ library Clones {
      * @dev Same as {xref-Clones-clone-address-}[clone], but with a `value` parameter to send native currency
      * to the new contract.
      *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
+     *
      * NOTE: Using a non-zero value at creation will require the contract using this function (e.g. a factory)
      * to always have enough balance for new deployments. Consider exposing this function under a payable method.
      */
@@ -59,6 +67,10 @@ library Clones {
      * This function uses the create2 opcode and a `salt` to deterministically deploy
      * the clone. Using the same `implementation` and `salt` multiple times will revert, since
      * the clones cannot be deployed twice at the same address.
+     *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
      */
     function cloneDeterministic(address implementation, bytes32 salt) internal returns (address instance) {
         return cloneDeterministic(implementation, salt, 0);
@@ -68,6 +80,10 @@ library Clones {
      * @dev Same as {xref-Clones-cloneDeterministic-address-bytes32-}[cloneDeterministic], but with
      * a `value` parameter to send native currency to the new contract.
      *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
+     *
      * NOTE: Using a non-zero value at creation will require the contract using this function (e.g. a factory)
      * to always have enough balance for new deployments. Consider exposing this function under a payable method.
      */
@@ -128,6 +144,10 @@ library Clones {
      * access the arguments within the implementation, use {fetchCloneArgs}.
      *
      * This function uses the create opcode, which should never revert.
+     *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
      */
     function cloneWithImmutableArgs(address implementation, bytes memory args) internal returns (address instance) {
         return cloneWithImmutableArgs(implementation, args, 0);
@@ -137,6 +157,10 @@ library Clones {
      * @dev Same as {xref-Clones-cloneWithImmutableArgs-address-bytes-}[cloneWithImmutableArgs], but with a `value`
      * parameter to send native currency to the new contract.
      *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
+     *
      * NOTE: Using a non-zero value at creation will require the contract using this function (e.g. a factory)
      * to always have enough balance for new deployments. Consider exposing this function under a payable method.
      */
@@ -165,6 +189,10 @@ library Clones {
      * This function uses the create2 opcode and a `salt` to deterministically deploy the clone. Using the same
      * `implementation`, `args` and `salt` multiple times will revert, since the clones cannot be deployed twice
      * at the same address.
+     *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
      */
     function cloneDeterministicWithImmutableArgs(
         address implementation,
@@ -178,6 +206,10 @@ library Clones {
      * @dev Same as {xref-Clones-cloneDeterministicWithImmutableArgs-address-bytes-bytes32-}[cloneDeterministicWithImmutableArgs],
      * but with a `value` parameter to send native currency to the new contract.
      *
+     * WARNING: This function does not check if `implementation` has code. A clone that points to an address
+     * without code cannot be initialized. Initialization calls may appear to be successful when, in reality, they
+     * have no effect and leave the clone uninitialized, allowing a third party to initialize it later.
+     *
      * NOTE: Using a non-zero value at creation will require the contract using this function (e.g. a factory)
      * to always have enough balance for new deployments. Consider exposing this function under a payable method.
      */