F-2025-0019·evm-misuse

Use of blockhash(block.number) Returns Zero in generateSalt()

Fixedliquid-stakinglststaking-poolsgithub.com/matchain/contracts
TL;DR

generateSalt() builds the CREATE2 salt from blockhash(block.number), which always returns zero per the EVM spec. The salt loses one of its three intended entropy sources.

Severity
LOW
Impact
LOW
Likelihood
HIGH
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The generateSalt() function is intended to produce a unique salt for use with CREATE2 by combining a blockhash, the caller's address, and a nonce:

solidity
function generateSalt() internal returns (bytes32) {
saltNonce++;
return keccak256(abi.encodePacked(blockhash(block.number), msg.sender, saltNonce));
}

However, blockhash(block.number) always returns zero per the EVM specification. The blockhash() opcode only returns a valid value for the previous 256 blocks, excluding the current block.

As a result, this line: blockhash(block.number) contributes no entropy and is effectively a constant zero.

03Section · Impact

Impact

The salt's entropy reduces to keccak256(abi.encodePacked(0, msg.sender, saltNonce)). Uniqueness is still guaranteed by saltNonce, but the intended use of blockhash entropy is silently lost.

04Section · Recommendation

Recommendation

Update the code to use blockhash(block.number - 1), which is valid:

solidity
function generateSalt() internal returns (bytes32) {
saltNonce++;
return keccak256(abi.encodePacked(blockhash(block.number - 1), msg.sender, saltNonce));
}
F-2025-0019

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx