CREATE2 factory permits same-address redeploy

Sanctum's assessment for RD-F-144 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Sanctum uses Solana BPFLoaderUpgradeable, not CREATE2. Program IDs are stable on Solana; the upgrade authority controls bytecode at the same program ID. Same-address redeployment with different bytecode is not the attack vector on Solana.

Sources #

Docs
Solana BPFLoaderUpgradeable — not CREATE2Solana BPFLoaderUpgradeable spec: no CREATE2 equivalent; program ID stableretrieved 2026-05-04

Methodology #

Determine whether a CREATE2 factory deployment allows redeployment to the same address with different bytecode (via selfdestruct + redeploy pattern).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol sanctum factor RD-F-144 score not_applicable collected_at 2026-05-04 18:49:23