# `CREATE2` address collision against an Account will allow complete draining of lending pools

User-controlled CREATE2 salt enables address collision with an undeployed Arcadia account, allowing infinite collateralization and draining of lending pools.

- Payout: Contest reward
- Severity: medium
- Program: Arcadia
- Credited: PUSH0
- Disclosed: 2023-12-17
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-12-arcadia-judging/issues/59
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** Factory.createAccount CREATE2 account deployment
**Root cause:** createAccount uses a user-supplied salt and tx.origin in CREATE2, letting an attacker brute-force a collision between an undeployed account address and an attacker-controlled contract address.
**Steps:**
1. Brute-force salts to precompute many undeployed Arcadia account addresses (2^80) and store in a Bloom filter.
2. Brute-force CREATE2 deployments of an attacker contract to find an address collision with any stored account address.
3. Tx1: deploy attacker contract at collided address, set infinite token allowance to attacker wallet, selfdestruct in same tx.
4. Tx2: deploy Arcadia account at collided address, deposit and collateralize asset, then drain collateral via allowance set in tx1.
5. Repeat collateralization to become infinitely collateralized, borrow all pool funds via flash loan, repay loan and keep profit.
**How found:** Researcher noticed user-controlled salt and tx.origin in CREATE2 deployment, hypothesized meet-in-the-middle collision attack, and verified EVM properties (redeployment after selfdestruct, allowance persistence) with a coded PoC.
**Exploitation:** Attacker finds a CREATE2 address collision, deploys a malicious contract at the collided address that sets infinite allowances and selfdestructs in one transaction, then deploys an Arcadia account at the same address, repeatedly deposits and drains collateral to inflate collateral value, borrows all pool funds, and exits.
**Escalation:** Repeated collateralization creates infinite borrow power; attack can be replicated across multiple EVM chains to drain multiple pools.
**Insight:** When a contract address is derived from user-controlled inputs via CREATE2, consider meet-in-the-middle brute-force collisions; even if costly, the impact of draining a pool may justify the expense, especially as hardware improves.