# zeroswap/UniswapV2Library.sol Wrong init code hash in UniswapV2Library.pairFor() will break UniswapV2Oracle, UniswapV2Router02, SushiRoll

Stale UniswapV2Pair init code hash in pairFor() computes wrong pair addresses, bricking UniswapV2Oracle, Router02 and SushiRoll swapping.

- Payout: Audit contest
- Severity: high
- Program: Canto
- Found by: WatchPug
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-newblockchain-findings/issues/164
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto%3AH-05
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:misconfiguration

**Target:** zeroswap UniswapV2Library.pairFor() Solidity library
**Root cause:** UniswapV2Pair bytecode was modified but the hardcoded init code hash in pairFor() was not updated, so CREATE2 address derivation yields non-existent pair addresses.
**Steps:**
1. Read UniswapV2Library.pairFor() and note hardcoded hex'e18a34eb...' init code hash
2. Compare against UniswapV2Factory.pairCodeHash() which reflects the modified UniswapV2Pair bytecode
3. Observe mismatch means keccak256(abi.encodePacked(hex'ff',factory,salt,initHash)) computes wrong address
4. Trace callers: UniswapV2Oracle, UniswapV2Router02, SushiRoll all rely on pairFor()
5. Conclude swaps route to non-existent addresses, reverting/bricking functionality
**How found:** Code review of the library's hardcoded init code hash against the actual factory pairCodeHash after the pair contract was modified.
**Insight:** When a fork modifies a UniswapV2Pair contract, always verify the hardcoded CREATE2 init code hash in pairFor() matches factory.pairCodeHash(); a stale hash silently breaks every periphery contract relying on pair address derivation.