# Attacker contract can avoid being blocked by BlockList.sol

BlockList only blocks addresses with code via extcodesize; attacker selfdestructs and recreates via CREATE2 to bypass blocking and keep interacting with lock functions.

- Payout: Contest reward
- Severity: medium
- Program: FIAT DAO
- Credited: JohnSmith
- Disclosed: 2022-10-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-fiatdao-findings/issues/75
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity BlockList contract / lock functions
**Root cause:** BlockList._isContract uses extcodesize, which returns 0 for addresses with no code; a contract can selfdestruct to erase its code and be recreated at the same address via CREATE2, evading the block.
**Steps:**
1. Deploy AttackerContract via AttackerFactory using `new AttackerContract{salt: bytes32("123")}()`
2. Interact with protocol functions gated by `checkBlocklist` (createLock, increaseAmount, increaseUnlockTime, delegate)
3. Call `destroy()` to `selfdestruct(payable(0))`, making extcodesize return 0
4. Recreate the contract at the same address via CREATE2 with the same salt when interaction is needed again
**How found:** Code review of BlockList.sol: noticed the block requires `_isContract(addr)` which only checks `extcodesize`, and reasoned that selfdestruct+CREATE2 makes code length zero at block time.
**Exploitation:** Attacker uses a CREATE2-deployed contract to perform protocol actions, selfdestructs to clear code so the blocklist check (extcodesize>0) fails to flag it, then redeploys at the same deterministic address to resume interactions such as locking LP tokens, increasing amount/unlock time, or delegating.
**Escalation:** Warden notes the bypass applies to all checkBlocklist-gated functions, not just createLock; also a recreated contract at a previously-used address could take ownership of prior state (analogous to Optimism/Wintermute incident).
**Insight:** Any on-chain blocklist/allowlist gated on extcodesize is bypassable: contracts have zero code length during construction and after selfdestruct, and CREATE2 lets an attacker deterministically re-materialize at the same address. Check for this pattern wherever address-based restrictions rely on code presence.