# Predicted address mismatch strands funds

Address used in accounting differs from where funds go, or is predictable before deployment

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-02-05. Updated 2026-10-29._

## How it works
Accounting code assumes an address is fixed and known: a vault, pool, or fee recipient. That assumption breaks in two ways. First, an address can be computed before the contract exists (CREATE/CREATE2), so guards that check "is this a real privileged contract" return false for a not-yet-deployed address, and funds or tokens can be parked there. Second, the address used in fee or share math can be a different copy from the one that actually receives tokens: one contract holds a mutable, owner-updatable value while another bakes an immutable copy into its math. Either way, balances and rewards drift from reality.

## Where it shows up
- Guards like `_isPublicVault(recipient)` or code-existence checks that gate transfers to privileged addresses.
- CREATE/CREATE2 deployment where the salt omits constructor args that affect init code.
- A mutable address (owner-settable) on one contract vs an immutable copy on a factory or pair.
- Fee/reward math reading address A while `transfer`/`mint` sends to address B.
- Precomputed addresses cached or passed into integrations.

## How to review
Identify every address that feeds accounting (fee recipient, vault, pool) and confirm it equals the address that actually receives value, at the moment of use. For predicted addresses, check whether the guard validates deployed code or tracks expected deployments rather than trusting runtime state. For CREATE2, verify the salt covers every constructor argument that changes init code, and that no mutable arg is excluded. Invariant: the address in the math and the address receiving funds are the same, and any precomputed address is stable under all mutable inputs.

## Variants seen
- Pre-transfer of tokens to a predictable not-yet-created vault, corrupting repayment accounting [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-14.md).
- Mutable vault address desynced from immutable factory copy, zeroing staker fees [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-19.md).
- CREATE2 salt missing mutable constructor args, so precomputed pool address differs from deployed [E3](https://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-02.md).

## Impact and severity
Led to blocked repayment and liquidation of collateral [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-14.md), loss of fees to stakers [E2](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-19.md), and broken integrations from wrong pool addresses [E3](https://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-02.md). Severity rises when the mismatch is silent and funds are already committed.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-19.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-02.md