# Improper Validation Of create2 Return Value

BeaconProxyDeployer.deploy() checks create2 result against zero address instead of extcodesize, so failed deployments silently return an address with no bytecode.

- Payout: Audit contest
- Severity: medium
- Program: Mochi
- Found by: leastwood
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/155
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AM-13
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:misconfiguration

**Target:** BeaconProxyDeployer.deploy() vault proxy deployment (Solidity/EVM)
**Root cause:** create2 returns the deterministic address which is never zero even when deployment fails or the constructor reverts; the code checks iszero(result) instead of verifying extcodesize(result) > 0, so a failed deploy is not detected.
**Steps:**
1. Read BeaconProxyDeployer.sol L31: `result := create2(...)` then `if iszero(result) { revert }`.
2. Observe create2 always yields the precomputed address, never 0x0, so the guard never triggers.
3. Trigger a failing deployment (e.g. constructor revert) and note the call returns an address with no code instead of reverting.
4. Fix: replace `iszero(result)` with `iszero(extcodesize(result))`.
**How found:** Manual code review of the deploy helper; noticed the zero-address check on create2's return value is semantically wrong since create2 returns a deterministic non-zero address regardless of deployment success.
**Insight:** For create2/create deployments, validate success via extcodesize of the returned address, not a zero-address check — the returned address is deterministic and never zero, so a naive iszero guard silently passes on failed deploys.