# Fraxlend pair deployment can be front-run by a custom pair deployment

Whitelisted user can front-run a Fraxlend pair deployment via deployCustom reusing the same salt/name, blocking the honest deployment permanently.

- Payout: Contest reward
- Severity: medium
- Program: Frax Finance
- Credited: berndartmueller
- Disclosed: 2023-01-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-frax-findings/issues/166
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-frax%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:dos

**Target:** FraxlendPairDeployer contract (create2 pair deployment)
**Root cause:** Salt is derived from _saltSeed and _configData; deployCustom lets a whitelisted caller choose an arbitrary _name (e.g. "public") producing the same salt as a standard deploy, and _deployFirst reverts if the salt is already registered.
**Steps:**
1. Watch mempool for `FraxlendPairDeployer.deploy(_configData)` from a standard pair deployment.
2. Call `deployCustom("public", _configData, ..., _maturityDate < block.timestamp, ...)` with the same `_configData` and name `public` to produce identical salt `keccak256(abi.encodePacked("public"))`.
3. Custom pair registers `deployedPairsBySalt[salt]` and is unusable due to `isNotPastMaturity` reverting on deposit/mint/borrow/addCollateral/leveragedPosition.
4. Honest `deploy` reverts with 'Pair already deployed'; same config can never be deployed again.
5. Alternative: front-run with same `_name` so `_deploySecond` reverts on 'Pair name must be unique'.
**How found:** Code review of _deployFirst salt derivation and deployCustom's user-controlled _name, noticing both paths share the same salt namespace and that _deployFirst reverts on duplicate salt.
**Exploitation:** A whitelisted (potentially dishonest) deployer monitors the mempool, sees a pending standard pair deployment, and submits a deployCustom tx with matching salt (name "public") and config but a past maturity date, consuming the salt and permanently blocking the honest pair.
**Insight:** When a factory derives create2 salt from user-influenced inputs, check whether a privileged/whitelisted path can mint the same salt as the public path — a griefing DoS that permanently burns the salt.