# CREATE2 address trusted without existence check

Is a locally computed CREATE2/CREATE address used as identity or target without confirming code exists there?

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2023-12-17. Updated 2026-11-02._

## How it works
A contract derives an address locally (CREATE2 from factory, salt, init hash; or CREATE from sender+nonce) and treats that derivation as proof of identity or as a safe call target. The derivation only says what address *would* exist if a deployment happened with those inputs; it says nothing about whether anything is deployed there. Anyone who can influence the inputs (salt, token pair, fee, nonce ordering) can steer the computed address toward one they control, or make a real deployment land elsewhere. The broken assumption: "the address I computed is the contract I mean."

## Where it shows up
- Callback or hook functions that check `msg.sender == computeAddress(...)` and nothing else [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).
- Factories taking a user-supplied salt (or `tx.origin`) into CREATE2 [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md).
- Fixes that bind a call to one field (a claim hash) but not to the contract instance or position [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md).
- Immutable routers or factories whose approvals/balances accrue over time, raising the payoff of a collision [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).

## How to review
The invariant: before an address is used as an identity or a call target, the code must confirm a contract actually exists there (EIP-684: nonzero code) and, where identity matters, that the factory records it as deployed. Check every `computeAddress`/`create2` result: is it followed by an `extcodesize`/factory lookup? Are the derivation inputs attacker-controllable? For CREATE (nonce) addresses, ask whether a reorg can reorder deployments and swap identities; if so, the binding must include the full context (which instance, which position), not just a claim hash [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md).

## How finders spotted it
- Read `swapCallback`, saw `msg.sender` checked only against a locally computed CREATE2 address with no factory existence check; then reasoned about truncated-keccak collision resistance and the 2^81/2^82 work factor, validating with a scaled-down PoC [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).
- Noticed user-controlled salt and `tx.origin` in CREATE2 account deployment; hypothesized a meet-in-the-middle collision and confirmed EVM properties (redeploy after selfdestruct, allowance persistence) with a PoC [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md).
- Read `move()` and the factory's clone deployment; saw the new `_claim` parameter bound only the claim hash, not game identity/position, and reasoned that nonce-derived addresses plus reorg reordering break the binding [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md).

## Variants seen
- Caller authentication by recomputed CREATE2 address, no existence check [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md).
- User-controlled salt enabling collision with an undeployed account, giving fake collateral [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md).
- Nonce-derived CREATE addresses swapped by reorg, so a valid move lands in the wrong game [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md).

## Impact and severity
E3: drain of all token allowances to the router; the router is immutable so approvals grow, and a reused EOA set lowers later attack cost [E3](https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md). E2: infinite collateralization and draining of lending pools, replicable across EVM chains [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md). E1: honest challenger loses their bond after a reorg [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md). Severity rises with attacker control over derivation inputs, the value of approvals/balances held by the target, and cross-chain or repeated applicability.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AM-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2.md