CREATE2 factory permits same-address redeploy
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor identifies whether the protocol uses a CREATE2 factory that permits redeployment to the same contract address with different bytecode — either via a selfDestruct-and-redeploy pattern or via a factory configuration that does not enforce deterministic address uniqueness. If redeployment is possible, the address ceases to be a reliable identifier for a specific contract's code.
Why it matters
CREATE2 factories that permit redeployment enable metamorphic contract attacks: an attacker (or a malicious governance proposal) can deploy an apparently-safe contract to a known address, accumulate user approvals or deposits, then self-destruct and redeploy a malicious version at the same address. The Tornado Cash governance attack in 2023 demonstrated this vector: a trojan governance proposal used CREATE2's malicious-contract-swap capability to deploy a contract that accumulated votes under an apparently benign façade, then swapped to a malicious implementation. The attack was executed at the governance layer; a protocol using a redeployable CREATE2 factory for its own core contracts carries the same risk in its own upgrade process.
Green / Yellow / Red
Green is assigned when the protocol does not use CREATE2 deployment for upgradeable core contracts, or when the factory is configured to prevent redeployment via a one-time-nonce burn or equivalent. Yellow covers use of CREATE2 for peripheral contracts with no self-destruct capability in the deployer. Red is assigned when core protocol contracts are deployed via CREATE2 with no guard against redeployment to the same address.
Common gray cases
This factor is grayed when the protocol does not use CREATE2 in its deployment architecture, or when the factory used is a well-audited standard implementation with verified non-redeployable configuration.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether a CREATE2 factory deployment allows redeployment to the same address with different bytecode (via selfdestruct + redeploy pattern).