Skip to content

Methodology

DISCLAIMER // NFA // DYOR

This analysis is based on a full disassembly of the deployed bytecode — the contract source code is not verified on Etherscan. The published upstream source was compiled locally and matches the on-chain creation bytecode byte for byte; that match was established by us, not by Etherscan. We are not smart contract security experts. This document should not be considered a comprehensive security audit or financial advice. Always verify critical information independently.

⊙ generated by robots | curated by humans

METADATA
Contract Address 0x4e59b448...B4956C (etherscan)
Network Ethereum Mainnet
Analysis Date 2026-10-30

Overview

The source is not verified on Etherscan, but the runtime is 69 bytes, small enough to read in full from a disassembly without a decompiler. Each opcode was traced by hand through the stack to establish what the contract does with Calldata, value, and the CREATE2 result.

The upstream repository publishes an 18-line Yul file and a build script. The Yul was compiled with the compiler version and optimizer settings the repository pins (solc 0.5.8, Yul optimizer on), and the output was compared byte for byte with the creation bytecode recorded on chain. They match. The comparison establishes that the upstream source is the source; the behaviour descriptions come from the disassembly, not from source comments or the README.

The Keyless Deployment was checked from the raw transaction: its fields were decoded, its signature compared with the values the build script hard-codes, and the contract address recomputed from the signer and nonce 0.

Behaviour that the disassembly predicts but that is easy to misread was confirmed on a local anvil fork of mainnet pinned to block 26,306,072 (etherscan), sending from anvil's unlocked dev account. The tests covered the return format, the constructor's view of msg.sender and tx.origin, a repeated salt, short calldata, empty init code, ETH forwarding on success and on failure, and both code-size limits. No transaction was sent to mainnet.

Presence on seven further chains was read from each chain's public Remote Procedure Call (RPC) endpoint: runtime code, the proxy's nonce, the signer's nonce, and whether the keyless transaction hash exists on that chain. Where the signer's nonce was still 0, genesis state and the chain's Blockscout creation record were checked. What happens when the keyless transaction meets an address that already holds the code was tested on a local anvil chain.

Thought Process

mindmap
  root((Deterministic Deployment Proxy))
    Obtain
      Runtime 69 bytes via cast code
      Etherscan v2
        Not verified
        Creation tx and bytecode
    Source identity
      Upstream Yul
      solc 0.5.8 compile
      Byte-for-byte match
    Keyless deployment
      r = s = 0x22..22, v = 27
      No chain id
      Signer nonce now 1
      compute-address matches
      Funder sent exactly 0.01 ETH
    Runtime trace
      len = calldatasize - 32
      CREATE2 value, mem, salt
      Empty revert on zero
      Return 20 raw bytes
      No SLOAD SSTORE CALLER ORIGIN
    Fork tests
      msg.sender is factory
      tx.origin is submitter
      Duplicate salt reverts
      Short calldata out of gas
      ETH forwarded or reverted
      EIP-170 and EIP-3860 limits
    Cross-chain
      8 chains, code matches on all
      5 via keyless tx
      Arbitrum code at Nitro genesis, keyless tx reverted
      MegaETH at genesis
      Robinhood origin unresolved
      Occupied-address replay fails, nonce spent
    Usage
      Nonce 56,172
      Foundry default create2_deployer

Verification Guide

External Resources

Commandline Tools

Tip

Commands below use cast from the Foundry Toolkit. To run the commands below, you must set the RPC URL environment variable:

export ETH_RPC_URL=https://eth.llamarpc.com

Fetch and Disassemble the Runtime

The runtime is short enough that the disassembly is the analysis.

# FETCH RUNTIME BYTECODE (69 BYTES)

cast code 0x4e59b44847b379578588920cA78FbF26c0B4956C


# DISASSEMBLE

cast disassemble $(cast code 0x4e59b44847b379578588920cA78FbF26c0B4956C)


# CONFIRM NO STORAGE, CALLER OR ORIGIN OPCODES (EXPECT NO OUTPUT)

cast disassemble $(cast code 0x4e59b44847b379578588920cA78FbF26c0B4956C) | grep -E 'SLOAD|SSTORE|CALLER|ORIGIN|DELEGATECALL|SELFDESTRUCT'

Verify the Keyless Deployment

The raw transaction carries the hand-chosen signature, and the contract address follows from the signer at nonce 0.

# RAW SIGNED DEPLOYMENT TRANSACTION (ENDS IN 1b a0 22..22 a0 22..22)

cast tx 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 --raw


# TRANSACTION FIELDS: NONCE 0, GAS PRICE 100 GWEI, GAS 100000, NO CHAIN ID

cast tx 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 --json | jq '{nonce, gasPrice, gas, v, r, s, from}'


# GAS USED (68131)

cast receipt 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 gasUsed


# RECOMPUTE THE CONTRACT ADDRESS FROM SIGNER AND NONCE 0

cast compute-address 0x3fab184622dc19b6109349b94811493bf2a45362 --nonce 0


# SIGNER NONCE (1: ITS ONLY TRANSACTION IS SPENT) AND STRANDED BALANCE

cast nonce 0x3fab184622dc19b6109349b94811493bf2a45362
cast balance 0x3fab184622dc19b6109349b94811493bf2a45362 --ether

Reproduce the Bytecode from Source

# CLONE UPSTREAM AND COMPILE THE YUL WITH THE PINNED COMPILER

git clone https://github.com/Arachnid/deterministic-deployment-proxy
cd deterministic-deployment-proxy
jq -n --rawfile src source/deterministic-deployment-proxy.yul \
  '{language:"Yul", sources:{"p.yul":{content:$src}},
    settings:{optimizer:{enabled:true, details:{yul:true}},
              outputSelection:{"*":{"*":["evm.bytecode.object"]}}}}' \
  | npx -y solc@0.5.8 --standard-json \
  | jq -r '.contracts["p.yul"].Proxy.evm.bytecode.object'


# COMPARE WITH THE ON-CHAIN CREATION BYTECODE (TRANSACTION INPUT)

cast tx 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 input

Count Deployments

# CONTRACT NONCE AT A PINNED BLOCK. CONTRACTS START AT NONCE 1 (EIP-161),
# SO NONCE - 1 = CONTRACTS CREATED

cast nonce 0x4e59b44847b379578588920cA78FbF26c0B4956C --block 26306072


# FOUNDRY'S DEFAULT CREATE2 DEPLOYER (RUN IN ANY DIRECTORY)

forge config | grep create2_deployer

Predict and Simulate a Deployment

# PREDICT THE ADDRESS FOR A SALT AND INIT CODE

cast create2 --deployer 0x4e59b44847b379578588920cA78FbF26c0B4956C \
  --salt 0x00000000000000000000000000000000000000000000000000000000000000d2 \
  --init-code 0x336000553260015560006000f3


# SIMULATE: CALLDATA IS SALT ‖ INIT CODE; RETURN IS 20 RAW BYTES

cast call 0x4e59b44847b379578588920cA78FbF26c0B4956C \
  0x00000000000000000000000000000000000000000000000000000000000000d2336000553260015560006000f3

Check Other Chains

Each chain was queried for the runtime code, both nonces, and the keyless transaction by its hash, which is the same on every chain. The receipt status matters: a signer nonce of 1 shows only that the transaction was included, and on a chain where the code was already present it is included and reverts.

# CODE, PROXY NONCE, SIGNER NONCE AND KEYLESS TX ON A GIVEN CHAIN (BASE SHOWN)

RPC=https://mainnet.base.org
cast code 0x4e59b44847b379578588920cA78FbF26c0B4956C --rpc-url $RPC
cast nonce 0x4e59b44847b379578588920cA78FbF26c0B4956C --rpc-url $RPC
cast nonce 0x3fab184622dc19b6109349b94811493bf2a45362 --rpc-url $RPC
cast tx 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 --rpc-url $RPC
cast receipt 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 status --rpc-url $RPC


# ARBITRUM ONE: CODE PRESENT AT NITRO GENESIS, BEFORE THE KEYLESS TX

cast code 0x4e59b44847b379578588920cA78FbF26c0B4956C --block 22207817 --rpc-url https://arb1.arbitrum.io/rpc
cast receipt 0xeddf9e61fb9d8f5111840daef55e5fde0041f5702856532cdbb5a02998033d26 status --rpc-url https://arb1.arbitrum.io/rpc


# MEGAETH: CODE ALREADY PRESENT AT GENESIS

cast code 0x4e59b44847b379578588920cA78FbF26c0B4956C --block 0 --rpc-url https://mainnet.megaeth.com/rpc

The scripts covering all eight chains and the occupied-address test are reproduced in Artifacts.

The full fork test script, fork-tests.sh, is reproduced in Artifacts.

Document Verification

The drafted documents were re-checked before publication in five independent passes, each with a narrow scope and each reading from primary sources rather than from the draft. Each pass had one scope, so a well-formatted claim could not pass the fact check by default.

DIMENSION WHAT IT CHECKS CHECKED AGAINST
Facts Addresses, block heights, nonce and balance values, gas figures, dates, compiler version, opcode offsets, every quantitative claim Live chain state via cast, Etherscan API v2, the upstream repository at commit be3c5974, the local solc 0.5.8 compile, and the fork test output
Standards Address display format, explorer links on every on-chain reference, table casing, section separators, icon semantics, glossary term wrapping, nav registration AGENTS.md, docs/glossary.md, mkdocs.yml
Redundancy Duplicated tables and paragraphs across the six documents, and the same claim stated with different values in two places The document set itself
Voice Superlatives asserted without a verification clause, opinion adjectives, speculation about intent or users AGENTS.md writing standards
Filler Rhetorical padding — meta-narration, telegraphed structure, formulaic emphasis AGENTS.md anti-patterns

Every disagreement the fact pass raised was re-derived from chain or source before any edit was made, on the assumption that the checker is as capable of being wrong as the draft. A claim was only changed where the contradicting value could be reproduced from a command in the Verification Guide above.

Token Cost Breakdown

PHASE DESCRIPTION TOKENS
Phase 0 Obtain the Contract 35 tok
Phase 1 Discovery & Understanding 65 tok
Phase 2 Deep Dive Analysis 30 tok
Phase 3 Risk & Trust Analysis 10 tok
Phase 4 Documentation Generation 55 tok
Phase 5 Document Verification 540 tok
TOTAL Complete Contract Analysis 735 tok

Phase 5 dominates because the fact-check pass re-ran the on-chain reads, the solc compile and the fork tests independently of the drafting pass, and three further reviewers read the full document set.

Note: Token costs are estimates based on typical conversation lengths and complexity. Actual consumption may vary by ±10-15% depending on API responses, iterative refinement, and verification steps.