Potential security implications of CREATE2? (EIP-1014)

[carver]

@rajeevgopalakrishna

this is a real exploitable concern, correct?

It’s not an EVM exploit, exactly, but it is a way to maybe make auditors’ jobs more difficult. There are ways around each of these “social attacks”, but most of them require education. That will surely lag behind the Constantinople upgrade itself.

@rajeevgopalakrishna

By ‘reset’, do you mean re-create the malleable deployer contract using CREATE2 at the same address? Keeping a flag-bit for CREATE2 only contracts would prevent this, won’t it? You won’t be able to reset the deployer contract and hence the nonce.

Right, if you prevent CREATE2 redeploys, then you prevent CREATE redeploys, as far as I can tell.