# CREATE3 is not available in the zkSync Era.

Gitcoin's Registry uses CREATE3 for anchor deployment, which is unsupported on zkSync Era, so generateAnchor fails and anchors register to wrong addresses.

- Payout: Contest reward
- Severity: medium
- Program: Gitcoin
- Credited: 0xc0ffEE
- Disclosed: 2023-09-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-Gitcoin-judging/issues/862
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:misconfiguration

**Target:** Registry.sol generateAnchor / CREATE3 deployment on zkSync Era
**Root cause:** CREATE3 relies on CREATE2 address derivation and arbitrary creation code, but zkSync Era's CREATE/CREATE2 semantics and address computation (zksyncCreate2 prefix) differ from Ethereum, so the precomputed address is wrong and deployment fails.
**Steps:**
1. Deploy Registry to zkSync Era per README-supported chain.
2. Call generateAnchor which invokes CREATE3.deploy with anchor creationCode.
3. Observe CREATE3.getDeployed precomputed address differs from actual deployed address / deployment fails.
4. Registry stores incorrect preCalculatedAddress, breaking anchor registration.
**How found:** Read README claiming zkSync Era support, then cross-referenced zkSync Era docs on CREATE/CREATE2 differences and the zksyncCreate2 address derivation, concluding CREATE3 library cannot work as-is.
**Insight:** When a protocol claims multi-chain/EVM-equivalent deployment, check chain-specific opcode/address-derivation differences (zkSync CREATE2 prefix, CREATE restrictions) against any CREATE3/deterministic-deployment library usage.