F-2025-0021·code-quality

Use of precomputed address to execute operations before actual deployment

Acknowledgedliquid-stakinglststaking-poolsgithub.com/matchain/contracts
TL;DR

mintPool computes the CREATE2 address via Create2.computeAddress(...) and uses it to mint NFTs, register pools, and emit events before the proxy is actually deployed. No security impact, but it is best practice to deploy first and then use the deployed address.

Severity
INFO
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

In the current implementation of mintPool(), the CREATE2-based address is precomputed using Create2.computeAddress(...), and this address is immediately used in downstream logic (minting NFTs, registering pools, emitting events), before the proxy is actually deployed:

solidity
address poolAddress = Create2.computeAddress(...);
ownershipNFT.mintPoolNFT(poolOwner, poolAddress, initialTokenURI);
token.registerNewPool(poolAddress, msg.sender);
...
BeaconProxy proxy = new BeaconProxy{salt: salt}(...);
03Section · Impact

Impact

Although it does not have a direct security impact, this issue is marked as informational because it is considered good practice to first deploy the contract and then use the deployed address.

04Section · Recommendation

Recommendation

Although it does not have a direct security impact, this issue is marked as informational because it is considered good practice to first deploy the contract and then use the deployed address.

F-2025-0021

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx