coinbase / coinbase/commerce-onchain-payment-protocol

[Architectural Flaw] CREATE2 Counterfactual Deployment Gap Strands Funds on BSC (Nonce 0 Replay Required)

Open
#73 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Solidity
Stars
205
Forks
92
PR merge metrics
No merged PRs in 30d

Description

This is an escalation regarding an architectural gap in Coinbase Commerce's CREATE2 infrastructure that is currently stranding ~$15,000 of user funds on BSC.

Tier 1 support (Case #27236519) lacks the technical context and misclassified this as an HD wallet derivation issue ("the wallet address in question is not associated with the merchant's HD wallet, even with a derivation path"). They do not understand that this is a smart contract forwarder.

The Technical Reality:
1. A payment of 4.602958 ETH was routed to a Commerce checkout address on BSC (chainId 56).
2. The destination is a deterministic forwarder generated by the Commerce Factory (`0xf6874c88757721a02f47592140905c4336DfBc61`).
3. Because the Factory was never deployed on BSC, the funds are sitting at an empty, counterfactual EOA.
4. The Fix: The exact Coinbase deployer (`0x60f7F36Fc9c823fd25FDf00FeEfc6D39bEd8B53B`) is currently sitting at exactly Nonce 0 on BSC. All it takes to rescue this $15k is for engineering to replay the original 9-transaction factory deployment sequence to BSC.
5. Once the factory is deployed, the `flushERC20` sweep becomes 100% permissionless. No custom code, no exposed private keys.

I have the full technical dossier and the EIP-191 cryptographic proof of origin ready. If that deployer key EVER signs a different transaction on BSC, the nonce advances and this recovery window closes permanently, destroying the user funds.

Can a protocol engineer take this 9-tx payload and broadcast it to chainId 56?

Contributor guide

No contributing guide indexed for this repository

Research direction

No repository files, tests, or deployment entry points are named. Start by reviewing the Commerce Factory, the stated deployer address, the chainId 56 context, and the claimed nine-transaction deployment sequence, then verify the EIP-191 proof and nonce-0 condition. Done means an authorized protocol engineer has determined whether the deployment and fund recovery are safe.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain, payments
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.