# create2WithStoredInitCode() does not revert if contract deployment failed

create2WithStoredInitCode ignores CREATE2 returning address(0), so deployMarket succeeds on failed deployment, charging origination fee and permanently blocking redeployment.

- Payout: Contest reward
- Severity: medium
- Program: Wildcat Protocol
- Credited: MiloTruck
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-wildcat-findings/issues/499
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** WildcatMarketController.deployMarket / LibStoredInitCode library
**Root cause:** create2WithStoredInitCode does not check whether the CREATE2 opcode returned address(0) on failed deployment, so callers proceed with a zero/no-code address.
**Steps:**
1. Configure protocolFeeBips > BIP (e.g. 1e4+1) via setProtocolFeeConfiguration with an origination fee asset.
2. Borrower approves origination fee and calls `controller.deployMarket(asset, namePrefix, symbolPrefix, ...)`.
3. WildcatMarket constructor reverts (InterestFeeTooHigh), CREATE2 returns address(0), but deployMarket does not revert.
4. Observe market.code.length == 0 and origination fee deducted from borrower.
5. Fix protocolFeeBips to valid value and retry deployMarket with same params: reverts MarketAlreadyExists because address(0) was registered.
**How found:** Code review of the assembly CREATE2 helper noticing the return value was never checked against address(0), then tracing callers (deployMarket) and the constructor revert paths that make deployment failure reachable.
**Exploitation:** Borrower triggers deployMarket with parameters that make the market constructor revert; the origination fee is still transferred and the zero address is registered as a market, permanently blocking redeployment with the same asset/name/symbol prefixes.
**Insight:** When auditing assembly wrappers around CREATE/CREATE2, verify the returned address is checked for zero; a silent failure propagates into state registration and fee accounting in the caller.