# Pool address is not deterministic, the actual Pool address deployed may be different from the address computed in advance

Maverick Pool create2 address depends on mutable constructor args, so precomputed pool addresses can differ from the deployed pool, breaking integrations.

- Payout: Audit contest
- Severity: medium
- Program: Maverick
- Found by: hihen
- Disclosed: 2023-05-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-12-stealth-project#m-02
- Library page: http://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Factory/Deployer create2 pool deployment
**Root cause:** Pool is deployed via create2 with a salt of only fee/tickSpacing/lookback/tokens, but the full constructor arg set (including _activeTick, _protocolFeeRatio, _tokenAScale, _tokenBScale) feeds into the create2 address, so mutable parameters change the resulting address.
**Steps:**
1. Read `Deployer.deploy()`: `new Pool{salt: keccak256(abi.encode(_fee, _tickSpacing, _lookback, _tokenA, _tokenB))}(...)` with all 10 args as constructor params.
2. Note create2 address = hash(deployer, salt, keccak256(init_code)), and init_code includes all constructor args.
3. Observe `_activeTick` is caller-chosen in `Factory.create()`, `_protocolFeeRatio` is owner-settable via `setProtocolFeeRatio`, and `_tokenAScale/_tokenBScale` derive from token decimals which may change for settable/upgradable tokens.
4. Conclude a user precomputing the pool address from fee/tickSpacing/lookback/tokens can get a different address than actually deployed, causing failed calls or lost tokens.
**How found:** Code review of the create2 deployment pattern comparing salt inputs against full constructor args, noting which args are mutable and not part of the pool identity keys.
**Insight:** When auditing create2 determinism, verify the salt covers every constructor argument that affects init_code; any mutable arg (owner-settable fee ratio, caller-chosen tick, token-derived scale) silently breaks address precomputation relied on by integrators.