# CREATE opcode works differently in the zkSync chain

TitlesCore.createEdition uses Solady LibClone.clone with CREATE opcode, which fails on zkSync Era, preventing edition creation and losing fees.

- Payout: Contest reward
- Severity: medium
- Program: Titles
- Credited: ArsenLupin
- Disclosed: 2024-04-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-titles-judging/issues/91
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity vuln:misconfiguration

**Target:** TitlesCore contract on zkSync Era
**Root cause:** LibClone.clone uses the CREATE opcode with runtime-generated bytecode, which zkSync Era does not support for arbitrary code unknown to the compiler.
**Steps:**
1. Deploy TitlesCore on zkSync Era.
2. Call createEdition with a valid payload and fee.
3. The clone function invokes CREATE with bytecode not known at compile time.
4. The CREATE opcode fails on zkSync Era, causing the transaction to revert and the fee to be lost.
**How found:** The auditor read the zkSync Era documentation on differences from Ethereum, specifically the CREATE opcode limitations, and noticed that TitlesCore uses LibClone.clone which relies on CREATE.
**Exploitation:** Any user calling createEdition on zkSync Era will have the transaction revert, losing the paid fee.
**Insight:** When auditing for multi-chain deployment, check for opcode-level differences (e.g., zkSync's CREATE) in library code like clone factories, even if the library is widely used.