# Unvalidated clone and deploy arguments

Do clone, CREATE2, or deploy arguments bind to a trusted implementation and check the returned address?

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-08-16. Updated 2026-10-24._

## How it works
Deployment helpers and clone patterns assume the caller-supplied arguments and the deployment result are trustworthy. That assumption breaks in two ways. First, clone-with-immutable-args stores arguments as calldata, so anyone calling the implementation directly can forge values that the implementation later trusts (factory, recipient, delegatecall target). Second, assembly CREATE/CREATE2 wrappers may ignore a failed deployment (address(0)) or derive addresses from nonces, so the deployed instance is not the one the caller believes it is. In both cases the contract proceeds with an identity or address that was never validated.

## Where it shows up
- `_getArgAddress()` / immutable-arg results feeding `delegatecall` or `call` targets [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-rio-vesting-escrow%3AH-1.md)
- Clone or proxy implementations callable directly, not only through the factory
- Assembly `create`/`create2` helpers whose return value is not compared to `address(0)` [E3](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-06.md)
- Deploy addresses derived from sender+nonce (CREATE) where reorgs can reorder them [E2](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md)
- Callers that register state or charge fees before confirming code exists at the new address [E3](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-06.md)
- Fixes that bind a call to one field (a hash) but not to the full instance/position context [E2](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md)

## How to review
Trace every deploy/clone argument from its source to its use. The invariant: any argument that selects an implementation, delegatecall target, or recipient must be bound to a trusted factory value, not to caller calldata. Check that the implementation cannot be invoked directly with forged args, or that forged args cannot reach a `delegatecall`. For assembly deploy helpers, confirm the returned address is checked against `address(0)` and that code exists before state is written. For CREATE-derived addresses, confirm the protocol tolerates reorg reordering, or that identity is bound explicitly. For a fix that adds a hash check, confirm it binds the full context (which contract, which position), not just one field [E2](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md).

## Variants seen
- Forged immutable args reach a `delegatecall` to a selfdestructing adaptor, bricking all clones [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-rio-vesting-escrow%3AH-1.md)
- Nonce-derived CREATE proxy addresses swapped by reorg, misdirecting an honest move [E2](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md)
- CREATE2 helper ignores `address(0)`, so deploy succeeds on failure and blocks redeployment [E3](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-06.md)

## Why fixes fail
E2's `move()` fix added a claim-hash check but did not bind game identity or position, so the reorg misdirection remained [E2](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md).

## Impact and severity
Outcomes ranged from permanent bricking of all escrows [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-rio-vesting-escrow%3AH-1.md) to loss of a challenger's bond [E2](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md) to charged fees and blocked redeployment [E3](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-06.md). Severity rises when the forged or failed address is trusted for delegatecall or fee accounting, and when no recovery path exists.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-01-rio-vesting-escrow%3AH-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-06.md