Skip to content

Functions

DISCLAIMER // NFA // DYOR

This analysis is based on a full disassembly of the deployed bytecode — the contract source code is not verified on Etherscan. The published upstream source was compiled locally and matches the on-chain creation bytecode byte for byte; that match was established by us, not by Etherscan. We are not smart contract security experts. This document should not be considered a comprehensive security audit or financial advice. Always verify critical information independently.

⊙ generated by robots | curated by humans

METADATA
Contract Address 0x4e59b448...B4956C (etherscan)
Network Ethereum Mainnet
Analysis Date 2026-10-30

Function Selectors

SELECTOR FUNCTION SIGNATURE CATEGORY
none fallback() — every call, regardless of calldata User

The runtime has no selector dispatcher. There is no CALLDATALOAD-and-compare preamble, and the first opcode is the arithmetic for the init code length. Etherscan's "method" column for this address shows the first four bytes of whatever salt the caller chose, which is why it appears to list many different Function Selectors.

Summary

CATEGORY COUNT
Total Functions 1
User Functions 1
Admin Functions 0
View Functions 0

User Functions

Function: fallback() — deploy

Deploys the init code in Calldata bytes [32:] with CREATE2, using calldata bytes [0:32] as the salt and forwarding msg.value to the new contract. Returns the new contract's address as 20 raw bytes.

ATTRIBUTE VALUE
Selector None — the whole calldata is the input
Parameters salt (bytes 0–31), initCode (bytes 32–end). Raw concatenation, not Application Binary Interface (ABI) encoded
Access Anyone, payable
Returns bytes20 — the deployed address, unpadded
FLAG OBSERVATION
☑ Contains no SLOAD, SSTORE, CALLER, ORIGIN, DELEGATECALL or SELFDESTRUCT opcode; makes no call other than CREATE2
☑ All ETH sent is forwarded to the child. A failed deployment reverts the call, so ETH cannot be left behind by this code path
◇ The child's constructor runs with msg.sender equal to this contract and tx.origin equal to whoever submitted the transaction. Confirmed on a fork by deploying init code that writes both values to storage
△ Revert data from a failing constructor is discarded. A reverting constructor and an already-occupied address produce the same empty revert
△ Calldata shorter than 32 bytes underflows the length computation (calldatasize − 32); see Failure Cases
◇ Calldata of exactly 32 bytes runs CREATE2 with empty init code. The call succeeds and creates a codeless account at the corresponding address
◇ The return value is 20 bytes, not a 32-byte ABI word. Solidity callers must read it with assembly or address(bytes20(ret)), not abi.decode(ret, (address))
CONDITION REQUIREMENT
Calldata length ≥ 32 bytes, or the call runs out of gas
Target address keccak256(0xff ‖ proxy ‖ salt ‖ keccak256(initCode))[12:], where proxy is 0x4e59b448...B4956C (etherscan), must not already hold code or a nonzero nonce
Constructor Must not revert, and must fit within the gas forwarded
STEP ACTION
1 len = calldatasize − 32 (unchecked)
2 calldatacopy(0, 32, len) — init code into memory at offset 0
3 salt = calldataload(0)
4 addr = create2(callvalue, 0, len, salt)
5 If addr == 0: revert(0, 0)
6 mstore(0, addr); return(12, 20) — the low 20 bytes of the word

The contract has no storage; these are account-level changes.

VARIABLE CHANGE
Account nonce Incremented by one on each successful deployment (the only state this contract changes about itself)
Child account Created with the runtime code its constructor returned and a balance of msg.value
CONDITION REVERT MESSAGE
Constructor reverts or runs out of gas Empty revert (0x)
Target address already occupied Empty revert (0x)
Calldata < 32 bytes Exceptional halt (CALLDATACOPY of ~2²⁵⁶ bytes runs out of gas) — all forwarded gas consumed, no revert data
Init code returns runtime code > 24,576 bytes (EIP-170) Empty revert (0x)
Init code longer than 49,152 bytes (EIP-3860, since Shanghai) Exceptional halt (CreateInitCodeSizeLimit on the fork) — all forwarded gas consumed

Upstream Yul source (runtime object). The creation bytecode it compiles to with solc 0.5.8 matches the on-chain creation bytecode exactly; see Artifacts.

calldatacopy(0, 32, sub(calldatasize(), 32))
let result := create2(callvalue(), 0, sub(calldatasize(), 32), calldataload(0))
if iszero(result) { revert(0, 0) }
mstore(0, result)
return(12, 20)

Disassembly of the 69-byte runtime, annotated:

00  PUSH32 0xff…e0        ; −32 (two's complement)
21  CALLDATASIZE
22  ADD                   ; len = calldatasize − 32
23  PUSH1 0x00
25  DUP2
26  PUSH1 0x20
28  DUP3
29  CALLDATACOPY          ; mem[0:len] = calldata[32:]
2a  DUP1
2b  CALLDATALOAD          ; salt = calldata[0:32]
2c  DUP3
2d  DUP3
2e  CALLVALUE
2f  CREATE2               ; create2(value, 0, len, salt)
30  DUP1
31  ISZERO
32  ISZERO
33  PUSH1 0x39
35  JUMPI                 ; success → 0x39
36  DUP2
37  DUP3
38  REVERT                ; revert(0, 0)
39  JUMPDEST
3a  DUP1
3b  DUP3
3c  MSTORE                ; mem[0:32] = addr
3d  POP
3e  POP
3f  POP
40  PUSH1 0x14
42  PUSH1 0x0c
44  RETURN                ; return mem[12:32]

flowchart TD
    A["Call with calldata = salt ‖ initCode, value = v"] --> B["len = calldatasize − 32"]
    B --> C{"calldatasize < 32?"}
    C -->|yes| OOG["CALLDATACOPY of ~2²⁵⁶ bytes<br/>out of gas"]
    C -->|no| D["copy initCode to memory"]
    D --> E["CREATE2(v, initCode, salt)"]
    E --> F{"address == 0?"}
    F -->|"yes: constructor reverted<br/>or address occupied"| R["revert(0, 0)"]
    F -->|no| S["return 20-byte address"]