# Aquifer is vulnerable to Metamorphic Contract Attack

Aquifer's cloneDeterministic lets a self-destructing Well implementation be redeployed with new bytecode at the same address, silently changing logic behind an existing Well.

- Payout: Contest reward
- Severity: medium
- Program: Basin
- Credited: a3yip6
- Disclosed: 2023-10-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-basin-findings/issues/168
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-basin%3AM-09
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:misconfiguration

**Target:** Aquifer.boreWell / cloneDeterministic (CREATE2 clone factory)
**Root cause:** cloneDeterministic derives the Well address solely from the implementation address and salt; if the implementation can self-destruct, a metamorphic contract can be redeployed at the same implementation address with different bytecode, yielding a different Well at the same clone address.
**Steps:**
1. Deploy Well_Implementation1 at address 1.
2. Call `Aquifer.boreWell(address1, immutableData, initCall, salt)` to deploy Well1 at address 2 via CREATE2.
3. Self-destruct Well_Implementation1 and redeploy Well_Implementation2 at address 1 using a metamorphic factory.
4. Call `Aquifer.boreWell(address1, ...)` again with same salt; CREATE2 yields address 2 now running Well_Implementation2 logic.
**How found:** Code reading of boreWell/cloneDeterministic: noticed CREATE2 address depends only on implementation address and salt, combined with knowledge of the metamorphic contract technique (0age) where self-destruct enables redeployment at the same address.
**Exploitation:** Attacker controls the implementation contract, self-destructs it, redeploys different bytecode at the same address, then re-bores with the same salt so the recorded Well address now executes attacker-chosen logic against users who trust the prior implementation.
**Insight:** Any CREATE2 clone factory that keys the address on an implementation address is only as immutable as that implementation; check whether the implementation can self-destruct or be replaced, since that reopens the same deterministic address with new code.