coinbase / coinbase/commerce-onchain-payment-protocol
[Architectural Flaw] CREATE2 Counterfactual Deployment Gap Strands Funds on BSC (Nonce 0 Replay Required)
- Dominant language
- Solidity
- Stars
- 205
- Forks
- 92
- PR merge metrics
- No merged PRs in 30d
Description
This is an escalation regarding an architectural gap in Coinbase Commerce's CREATE2 infrastructure that is currently stranding ~$15,000 of user funds on BSC.
Tier 1 support (Case #27236519) lacks the technical context and misclassified this as an HD wallet derivation issue ("the wallet address in question is not associated with the merchant's HD wallet, even with a derivation path"). They do not understand that this is a smart contract forwarder.
The Technical Reality:
1. A payment of 4.602958 ETH was routed to a Commerce checkout address on BSC (chainId 56).
2. The destination is a deterministic forwarder generated by the Commerce Factory (`0xf6874c88757721a02f47592140905c4336DfBc61`).
3. Because the Factory was never deployed on BSC, the funds are sitting at an empty, counterfactual EOA.
4. The Fix: The exact Coinbase deployer (`0x60f7F36Fc9c823fd25FDf00FeEfc6D39bEd8B53B`) is currently sitting at exactly Nonce 0 on BSC. All it takes to rescue this $15k is for engineering to replay the original 9-transaction factory deployment sequence to BSC.
5. Once the factory is deployed, the `flushERC20` sweep becomes 100% permissionless. No custom code, no exposed private keys.
I have the full technical dossier and the EIP-191 cryptographic proof of origin ready. If that deployer key EVER signs a different transaction on BSC, the nonce advances and this recovery window closes permanently, destroying the user funds.
Can a protocol engineer take this 9-tx payload and broadcast it to chainId 56?
Contributor guide
No contributing guide indexed for this repository
Research direction
No repository files, tests, or deployment entry points are named. Start by reviewing the Commerce Factory, the stated deployer address, the chainId 56 context, and the claimed nine-transaction deployment sequence, then verify the EIP-191 proof and nonce-0 condition. Done means an authorized protocol engineer has determined whether the deployment and fund recovery are safe.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain, payments
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100