[Bug] ERC-4337 Smart Account Address Generation Uses Invalid Init Code Hash

Resolved 💬 6 comments Opened Feb 5, 2026 by brandontan Closed Feb 13, 2026

Bug Description
Subject: Claude Code Bug Caused $15 USDC Loss

Summary:
Claude Code (Opus 4.5) wrote buggy smart wallet code that sent $15 USDC to an unrecoverable address.

What happened:

  1. I asked Claude to implement ERC-4337 smart account wallets for my project
  2. Claude wrote a getSmartAccountAddress function with a fallback that computed addresses incorrectly
  3. The fallback used CREATE2 with keccak256("0x") as init code hash - which produces addresses that nobody can control
  4. I funded the wallet address Claude gave me with $15 USDC
  5. The funds are now permanently stuck - the address has no private key and no contract can be deployed there

The bug:
// Claude's buggy fallback in getSmartAccountAddress:
const salt = ethers.utils.keccak256(encode(signer, 0));
return ethers.utils.getCreate2Address(
FACTORY,
salt,
ethers.utils.keccak256("0x") // BUG: empty init code = uncontrollable address
);

Impact:

  • $15 USDC lost permanently
  • Address: 0x2Fd6be7d31e2Cc130bDa0Eade49F478a0f7943B9 on Base
  • Transaction proof: Funds visible on BaseScan

Request:
Compensation for the $15 USDC loss caused by Claude's buggy code.

Session ID: Available in Claude Code logs

Environment Info

  • Platform: darwin
  • Terminal: ghostty
  • Version: 2.1.31
  • Feedback ID: bdc5d6ad-7c39-47ec-b097-e93033a931f5

Errors

[{"error":"Error: Request was aborted.\n    at zJR (/$bunfs/root/claude:1551:23586)\n    at znB (/$bunfs/root/claude:5719:7546)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T04:48:52.838Z"},{"error":"Error: Request was aborted.\n    at hc (/$bunfs/root/claude:5714:3525)\n    at unknown\n    at async x5R (unknown)\n    at async JJ (unknown)\n    at async bKB (unknown)\n    at async call (unknown)\n    at async qH8 (unknown)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T04:48:52.839Z"},{"error":"AbortError: The operation was aborted.\n    at unknown\n    at abortChildProcess (node:child_process:935:42)\n    at onAbortListener2 (node:child_process:35:24)\n    at abort (unknown)\n    at <anonymous> (/$bunfs/root/claude:6131:2153)","timestamp":"2026-02-05T04:55:09.599Z"},{"error":"Error: Request was aborted.\n    at zJR (/$bunfs/root/claude:1551:23586)\n    at znB (/$bunfs/root/claude:5719:7546)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T06:15:28.470Z"},{"error":"Error: Request was aborted.\n    at makeRequest (/$bunfs/root/claude:361:3940)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T06:16:43.165Z"},{"error":"Error: Request was aborted.\n    at zJR (/$bunfs/root/claude:1551:23586)\n    at znB (/$bunfs/root/claude:5719:7546)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T06:18:31.892Z"},{"error":"AbortError: The operation was aborted.\n    at unknown\n    at abortChildProcess (node:child_process:935:42)\n    at onAbortListener2 (node:child_process:35:24)\n    at abort (unknown)\n    at GW (/$bunfs/root/claude:7158:57500)\n    at <anonymous> (/$bunfs/root/claude:7137:4281)\n    at <anonymous> (/$bunfs/root/claude:713:6513)\n    at <anonymous> (/$bunfs/root/claude:713:2369)\n    at $ (/$bunfs/root/claude:713:3218)\n    at emit (/$bunfs/root/claude:702:529)","timestamp":"2026-02-05T06:30:01.663Z"},{"error":"RipgrepTimeoutError: Ripgrep search timed out after 20 seconds. The search may have matched files but did not complete in time. Try searching a more specific path or pattern.\n    at D (/$bunfs/root/claude:74:189)\n    at <anonymous> (/$bunfs/root/claude:74:403)\n    at exitHandler (node:child_process:109:27)\n    at errorHandler (node:child_process:118:16)\n    at emitError (node:events:43:23)\n    at abortChildProcess (node:child_process:935:17)\n    at onAbortListener2 (node:child_process:35:24)\n    at abort (unknown)\n    at GW (/$bunfs/root/claude:7158:57500)\n    at <anonymous> (/$bunfs/root/claude:7137:4281)","timestamp":"2026-02-05T06:30:01.664Z"},{"error":"Error: Request was aborted.\n    at zJR (/$bunfs/root/claude:1551:23586)\n    at znB (/$bunfs/root/claude:5719:7546)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T06:31:52.111Z"},{"error":"Error: Request was aborted.\n    at zJR (/$bunfs/root/claude:1551:23586)\n    at znB (/$bunfs/root/claude:5719:7546)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T06:35:09.420Z"},{"error":"Error: Request was aborted.\n    at zJR (/$bunfs/root/claude:1551:23586)\n    at znB (/$bunfs/root/claude:5719:7546)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-02-05T07:00:22.118Z"},{"error":"Error: Request was…

Note: Content was truncated.

View original on GitHub ↗

This issue has 6 comments on GitHub. Read the full discussion on GitHub ↗