# fCash of the wrong maturity and asset can be sent to wrapper address before wrapper is deployed 

Attacker pre-sends wrong-maturity/asset fCash to a predicted wrapper address before deployment, so post-deploy balance check reverts and minting is permanently bricked.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: 0x52
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-notional-coop-findings/issues/115
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-notional-coop%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ERC1155 wrapper contract deployed via create2
**Root cause:** onERC1155Received is only invoked when code exists at the recipient; a create2 address accepts tokens before deployment without the callback, so the wrapper's post-deploy single-asset check sees >1 fCash asset and always reverts.
**Steps:**
1. Compute the create2 wrapper address before deployment.
2. Send fCash of a different maturity or asset to that address; no code exists so onERC1155Received is not called and the transfer succeeds.
3. Wrapper is deployed; correct fCash is sent to it.
4. onERC1155Received checks held asset count, finds more than one fCash asset, and reverts, breaking mint permanently.
**How found:** Reasoned that ERC1155 receiver hooks only fire when recipient has code, combined with create2 predictable addresses, to find a pre-deployment griefing window.
**Exploitation:** Precondition: attacker knows the deterministic create2 address and can transfer fCash to it before deployment. Attacker sends mismatched fCash; after deployment every mint to the wrapper reverts, causing permanent loss of availability.
**Insight:** For create2-deployed contracts that validate holdings or rely on receiver callbacks, consider tokens sent to the address before deployment bypassing those callbacks; check whether post-deploy invariants assume a clean initial balance.