Introducing CertiK’s CREATE2 Audit Tool

CertiK warns that Ethereum's CREATE2 opcode can enable malicious actors to replace deployed contract code (when SELFDESTRUCT or DELEGATECALL are present), allowing redeployment at the same address and potential fund theft. The advisory explains the CREATE2 address derivation differences, demonstrates attack scenarios, notes detection challenges for contracts created in creation-chains, and promotes CertiK's CREATE2 Audit Tool and code audits as mitigations.