Factory deploy reverts instead of returning address when account already exists
| Title | Factory deploy reverts instead of returning address when account already exists |
|---|---|
| Reward | $5882, Unique |
| Contest | Sequence - 7 October 2025 on Code4rena |
| Author | pfapostol |
| Context | ERC4337 |
The Factory.deploy function uses create2 to deploy a wallet, but reverts with CreateCollision if the address already exists.
Per ERC-4337, factories that use deterministic creation must return the account address even if the account was already created (eip-4337) so that bundlers and entryPoint.getSenderAddress() can obtain the counterfactual address without failing. The implementation breaks that invariant: calling the factory when the account already exists reverts instead of returning the existing address, which breaks ERC-4337 flows — simulations, getSenderAddress, bundler logic and the user experience.
Sequence's wallet implementation and README both expect ERC-4337 compatibility, implementing validateUserOp and the rest, so the factory's behaviour matters for integration: README#erc-4337-integration.
Alpha: an ERC-4337 factory must not revert when asked for the account address, even if the account already exists.
Conclusion
This finding would earn you $5882, and requires mostly ERC-4337 knowledge.