# `Registry.sol` generate clone `Anchor.sol` never work. Profile owner cannot use their `Anchor` wallet

Registry deploys Anchor clones via CREATE3, so Anchor's constructor records the CREATE3 proxy as registry, breaking execute() and trapping deposited funds.

- Payout: Contest reward
- Severity: high
- Program: Gitcoin
- Credited: 0xG0P1
- Disclosed: 2023-09-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-09-Gitcoin-judging/issues/380
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Anchor clone contract deployed by Registry via CREATE3
**Root cause:** Anchor's constructor sets registry = Registry(msg.sender), but under Solady CREATE3 msg.sender is the intermediate proxy contract, not the Registry, so the stored registry address is a non-Registry proxy.
**Steps:**
1. Create profile via `registry().createProfile(nonce, name, metadata, owner, members)`
2. Fetch profile and cast `profile.anchor` to Anchor
3. Call `_anchor.registry()` and compare to `address(registry())` — they differ (points to CREATE3 proxy)
4. Call `Anchor.execute(...)` as profile owner; `registry.isOwnerOfProfile` call reverts since registry is the proxy
**How found:** Code reading of Anchor constructor and Solady CREATE3: noticed msg.sender under CREATE3 is an intermediate proxy, then wrote a Foundry test asserting `_anchor.registry() == address(registry())` to confirm the mismatch.
**Exploitation:** Any profile owner attempting to use their Anchor wallet finds execute() reverts because the stored registry is the CREATE3 proxy; ETH sent to the Anchor beforehand is permanently stuck since no execute path works.
**Insight:** When a contract deployed via CREATE3/CREATE2 factory reads msg.sender in its constructor, verify whether the immediate caller is the factory or an intermediate deployer proxy — assert the stored address equals the intended factory in a test.