Investigation into how a $7,000 wrong-chain transfer led to an official Safe Factory deployment.
News ·
An investigation into Safe's official factory deployments uncovered an unusual path to legitimacy: a contract now listed in Safe's canonical registry was not originally deployed by the Safe team, but by an independent actor and later accepted into the official deployments list. The specific address in question is 0xC22834581EbC8527d974F8a1c97E1bEA4EF910BC, which serves as the EIP-155 variant of GnosisSafeProxyFactory v1.3.0 on Ethereum, while Safe's older canonical factory sits at a different address.
The actor who deployed it had a practical motive rooted in cross-chain mechanics. Using Safe's Singleton Factory—a deterministic deployment tool—anyone calling it with identical salt and initcode parameters can produce the same contract address across compatible EVM chains. On Avalanche, a Safe proxy already existed at a specific address, created with the CREATE opcode (which makes the address dependent on factory and nonce, not setup parameters). To recreate that same address on Ethereum, a second party needed to stand up a factory at the identical address and drive its nonce to match, then call CREATE with arbitrary setup data. The motive crystallized around 7,000 USDT sent to the wrong chain: the funds arrived at that address on Ethereum in February 2022, months before any contract existed there, while the matching address on Avalanche already held a Safe proxy from December 2021.
What remains unconfirmed is whether the independent deployment was intentional preparation for the misdirected transfer, or whether the timing was coincidental. The bytecode matching the official specification meant Safe had no technical grounds to reject the deployment once discovered.