CREATE2 factory permits same-address redeploy

Save (formerly Solend)'s assessment for RD-F-144 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Solana does not use CREATE2. Program deployment on Solana uses BPFLoaderUpgradeable which assigns a static program address at first deploy and supports in-place upgrades (address does not change on upgrade). No CREATE2 factory redeployment attack surface exists.

Sources #

Internal
SOLANA_GOVERNANCE.md — Solana program address modelSOLANA_GOVERNANCE.md — Solana BPFLoaderUpgradeable static address; no CREATE2retrieved 2026-05-17

Methodology #

Determine whether a CREATE2 factory deployment allows redeployment to the same address with different bytecode (via selfdestruct + redeploy pattern).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol save factor RD-F-144 score not_applicable collected_at 2026-05-17 15:20:15