# Hardcoded address or network constant

Fixed address, chain id, program id or ABI used where deployment or chain varies

_Area: Smart contract access control and control flow. Seen in 10 disclosed reports; latest 2025-05-22. Updated 2026-10-23._

## How it works
Code assumes one fixed value is correct everywhere: a caller address, an endpoint id, a token program id, a chain-specific flag, or a struct layout. The assumption breaks when the contract is deployed through a factory proxy, on another chain, or against a second market instance. The stored or compared value then never matches reality, so lookups fail, authorization reverts, or calls go to the wrong target.

## Where it shows up
- Constructor reads `msg.sender` to record a factory/registry, but deployment goes through CREATE2/CREATE3 or a deployer proxy [E1](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-3.md).
- Lookup helpers called with literal `0`, `address(0)`, or empty values that can never equal stored fields [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-25.md).
- `require(msg.sender == storedAddress)` where the stored address is set once but multiple instances exist [E3](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-10.md).
- Clone/deploy libraries using raw opcodes or address derivation that differ per chain (zkSync) [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md).
- Token program ids or CPI helpers hardcoded instead of using the passed `token_program` account [E5](https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.4.md).
- Chain-specific init flags left at default on sidechains [E6](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-9.md).
- Struct field counts or function signatures assumed identical across chains [E8](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-11.md).

## How to review
For each constant, ask: does this value vary by deployment, chain, or instance? Trace where it is set and every comparison against it. The invariant: any address, id, or ABI used in a match or authorization check must be derived from the actual runtime context (the real caller, the passed account, the stored per-instance value), not a literal or a single global. For factories, confirm the constructor records the intended factory, not an intermediate proxy. For multi-chain claims, diff opcode semantics, address derivation, and target protocol ABIs per chain.

## Variants seen
- Factory proxy recorded as registry, trapping funds [E1](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-3.md)
- Hardcoded endpoint id breaks cross-chain lookup [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-25.md)
- Singleton dependency address breaks multi-market auth [E3](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-10.md)
- CREATE opcode unsupported on zkSync [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md)
- Legacy token program id blocks Token-2022 [E5](https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.4.md)
- Chain flag defaulting false on sidechains [E6](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-9.md)
- CREATE3 address derivation wrong on zkSync [E7](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md)
- Mainnet ABI assumed on Arbitrum [E8](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-11.md)

## Impact and severity
Funds trapped or permanently inaccessible [E1](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-3.md), liquidations never completing [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-25.md), bad debt from blocked loss accounting [E3](https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-10.md), DoS of swaps and sales [E5](https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.4.md), and broken deposits or deployments on sidechains [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md)[E6](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-9.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-11.md). Severity rises when the broken path holds user funds or is the only route to recover them.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AH-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AH-25.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-10.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AM-2.md
- E5: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.4.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AM-9.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-15.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-11.md