# CREATE2 address prediction and squatting

Deterministic deployment addresses that an attacker can occupy, collide with, or miscompute before use

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-02-05. Updated 2026-11-01._

## How it works
Contract addresses are not random: CREATE derives them from deployer address plus nonce, CREATE2 from deployer, salt and init code. Any code that treats a computed address as trustworthy assumes nobody else can occupy it first, and that the local computation matches what the real deployer will produce. Both assumptions break. An attacker who can predict a future address can pre-place an account or contract there, or brute-force a collision with it, so the legitimate deployment either fails, lands on hostile state, or is authenticated against the wrong party.

## Where it shows up
- Addresses computed locally from a salt/init-code and then used for authentication or routing, without confirming the contract exists on-chain [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).
- User-supplied or partially-supplied salts in factory deployment [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md).
- Salt or constructor args in the local `pairFor`/`computeAddress` differing from the actual deployer's inputs [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md).
- CREATE-based factories where address depends only on deployer nonce, on reorg-prone chains [E5](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-02.md).
- EVM bolted onto a non-EVM account system where other account types can hold an address the EVM treats as a contract [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-01.md).
- `try/catch` around `createPair`/deploy that swallows a revert and leaves a stale computed address [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md).

## How to review
For every computed address, check the invariant: the address used for trust or routing is the one the real deployer will actually produce, and it is either already deployed or cannot be pre-occupied. Concretely: diff the local salt and init-code byte-for-byte against the deployer's [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md); confirm a factory existence check (EIP-684) accompanies any `msg.sender == computedAddress` test [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md); ask whether salt inputs are attacker-controlled and whether collision cost is below the payoff [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md); check whether non-EVM account types can squat EVM contract addresses and whether `codeHash` is written for them [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-01.md); on reorg-prone chains, ask if a CREATE address can be frontrun [E5](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-02.md).

## How finders spotted it
- Read `SetAccount` and saw `codeHash` set only for `EthAccountI`; combined with shared EVM/Cosmos address space and deterministic contract addresses, hypothesized a vesting account could squat a future contract [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-01.md).
- Noticed user-controlled salt and `tx.origin` in CREATE2, hypothesized a meet-in-the-middle collision, verified EVM properties with a PoC [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md).
- Saw `swapCallback` authenticate `msg.sender` against a locally computed CREATE2 address with no factory existence check; reasoned about birthday bounds and validated with a scaled-down collision PoC [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).
- Diffed `pairFor`'s salt against the factory's deployment salt and noticed the `try/catch` hides the revert [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md).
- Reasoned about CREATE address derivation and reorg depths, hypothesizing an attacker occupies the address before the victim's re-executed tx [E5](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-02.md).

## Variants seen
- Non-EVM account type squatting a future EVM contract address, orphaning bytecode [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-01.md).
- User-salt CREATE2 collision enabling infinite collateralization [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md).
- Local CREATE2 recomputation used as caller authentication without existence check [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).
- Salt/arg mismatch between local computation and real deployer, bricking flow [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md).
- CREATE nonce squatting via reorg frontrun [E5](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-02.md).

## Impact and severity
Ranged from bricked bonding-curve completion [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md) to theft of user deposits [E5](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-02.md), infinite borrow power draining lending pools [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md), and draining all router token allowances [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md). Impact rose with value at the address: ecosystem-critical planned deployments [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-01.md), multi-chain replication [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md), and immutable routers accruing approvals over time [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-08.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-02.md