Same Contract Address Deployed Across 8 Chains via CREATE3 #538

Same Contract Address Deployed Across 8 Chains via CREATE3

Type: Key Management / Operational Risk
Status: Confirmed via on-chain bytecode verification

Location:

• docs/deployments.md
  https://github.com/layer-3/clearsync/blob/master/docs/deployments.md

On-Chain Address:

0xb5F3a9dD92270f55e55B7Ac7247639953538A261

Chains Affected (8 total):

On-Chain Verification:

• Arbitrum: ✅ 3413 bytes (0x608060405...)
• Base: ✅ 3413 bytes (bytecode IDENTICAL)
• BSC: ✅ 3413 bytes (bytecode IDENTICAL)

Description:

LiteVault (0xb5F3a9dD92270f55e55B7Ac7247639953538A261) and VoucherRouter (0x2A8B51821884CF9A7ea1A24C72E46Ff52dCb4F16) are deployed at the SAME address across 8 different chains using CREATE3 deterministic deployment. This means a single deployer private key controls all deployments simultaneously.

Risk Scenario:

• Deployer key leaked via CI/CD logs, GitHub Actions, or phishing
• Attacker deploys malicious LiteVault or VoucherRouter implementation
• Calls upgradeToAndCall() on all 8 chains
• User funds drained from ALL chains simultaneously
• No time for cross-chain reaction

Recommended Fix:

1. Use separate deployer keys per chain
2. Implement a cross-chain multisig with chain-specific signing (e.g. Gnosis Safe with distinct owner sets per chain)
3. Rotate existing CREATE3 deployer key if already used on mainnet
4. Add timelock + multi-sig for any upgradeability

Contact:

Telegram @semfck