# Contract deployment restriction can be bypassed

Initia's EVM keeper only checks deployer allowlist in Create/Create2 message handlers, so a permissioned deployer can deploy a factory that lets anyone deploy arbitrary contracts.

- Payout: Contest reward
- Severity: medium
- Program: Initia
- Credited: berndartmueller
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Cosmos SDK EVM module (x/evm keeper) Create/Create2 opcode handling
**Root cause:** assertAllowedPublishers is only invoked in the Create/Create2 message handlers, not in the EVM CREATE/CREATE2 opcode path (EVMCreateWithTracer), so contract-initiated deployments skip the allowlist check.
**Steps:**
1. Permissioned deployer submits a MsgCreate/MsgCreate2 deploying a factory contract (passes assertAllowedPublishers)
2. Factory contract executes CREATE/CREATE2 opcodes to deploy arbitrary child contracts
3. EVM::Create/Create2 path lacks the allowlist hook, so unpermissioned callers deploy arbitrary contracts via the factory
**How found:** Compared Initia's implementation against Evmos, which adds a create hook checked by EVM::Create/Create2; noticed Initia only checks in message handlers and traced EVMCreateWithTracer to confirm the opcode path is unchecked.
**Exploitation:** A single allowlisted deployer deploys a factory once; thereafter any user calls the factory to deploy arbitrary malicious contracts, fully bypassing the publisher restriction.
**Insight:** When an allowlist gates a privileged action, check every entry point to that action—message handlers vs. EVM opcodes—and compare against a reference implementation (Evmos) that hooks the opcode level.