# Chain opcode and semantics mismatch

Code assuming Ethereum opcode, CREATE, sign-mode or address-derivation semantics on a chain that differs

_Area: Smart contract access control and control flow. Seen in 4 disclosed reports; latest 2025-04-10. Updated 2026-11-01._

## How it works
A contract, indexer or interpreter is written against Ethereum's rules, then deployed or run where one of those rules differs. The assumption that breaks is "this opcode/tx type/address derivation behaves the same here." On zkSync Era, CREATE with runtime-generated bytecode and CREATE2 address derivation (a `zksyncCreate2` prefix) differ from Ethereum, so clone factories and CREATE3 libraries silently misbehave [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md). In an EVM-in-Cairo port, creation code leaves `bytecode_len`/`code_address` in a state the jumpdest path does not expect [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AM-09.md). On a Cosmos chain offering Ethereum sign mode, code infers "EVM tx" from the sign mode rather than the message type URL [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).

## Where it shows up
- Clone/CREATE3/deterministic-deployment libraries (`LibClone`, CREATE3 factories) in a protocol claiming multi-chain support [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md).
- READMEs or docs asserting "EVM-equivalent" or listing zkSync Era among supported chains [E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md).
- EVM interpreter ports: jump/jumpdest validation, `bytecode_len`, `code_address` handling for creation vs runtime code [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AM-09.md).
- Indexers/streaming hooks that branch on sign mode or a type-URL switch with no default [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).

## How to review
For each chain the code targets, list the opcodes and derivations it depends on and confirm each is supported with the same semantics. The invariant: any address or bytecode the code precomputes must equal what the target chain actually deploys, and any type classification must key on the real type, not a proxy signal. Check that creation-code paths initialize length/address fields the same way runtime paths do [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AM-09.md), and that type-URL switches handle unknown types instead of erroring the whole batch [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).

## How finders spotted it
- Read the zkSync Era docs on differences from Ethereum, then noticed `TitlesCore` uses `LibClone.clone`, which relies on CREATE [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md).
- Read a README claiming zkSync Era support, cross-referenced CREATE/CREATE2 and `zksyncCreate2` derivation docs, concluded CREATE3 cannot work as-is [E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md).
- Code review of `evm.cairo` jump: saw `bytecode_len` is nonzero for creation code, bypassing the range guard and calling `is_valid_jumpdest` with an unset `code_address` [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AM-09.md).
- Code reading of `ConvertCosmosTxToEthereumTx` and `unpackData`: the type-URL switch has no default, and Ethereum sign mode lets arbitrary Cosmos messages be classified as EVM txs [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).

## Variants seen
- Unsupported opcode in a library dependency (CREATE-based clone on zkSync) [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md).
- Wrong address derivation for deterministic deployment (CREATE3 vs `zksyncCreate2`) [E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md).
- Interpreter state mismatch for creation code in a ported EVM [E2](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AM-09.md).
- Type inference from sign mode instead of message type URL [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).

## Impact and severity
Ranges from broken core features (edition creation failing and fees lost [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md); anchor deployment failing or registering wrong addresses [E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md)) to a single transaction suppressing indexing of an entire block, hiding activity [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md). Impact rises when the mismatch hits a shared path (every tx in a block [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md)) or a deployment primitive others depend on [E4](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AM-09.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md