julien/love · #5

LOVE currently takes the wETH address as a constructor argument and trusts it. That argument lands in the creation code, so the CREATE2 address only matches across chains that happen to share a wETH deployment, and nothing checks the supplied address is really wETH rather than a typo or a lookalike ERC-20.

Replace the trusted address with a verified bytecode check, per docs/notes/weth.md:

Enumerate real wETH codehash values across the top chains by TVL, to size the allowlist from data rather than an estimate.
Add an ownerless WETHRegistry with no constructor arguments, so CREATE2 gives it the same address on every chain. register() accepts a candidate only if its codehash is in a compile-time allowlist and a 1-wei deposit/withdraw round-trip passes. Write-once, callable by anyone.
Make Love's constructor argument-less: it reads wETH from the registry and reverts if unset. The creation code becomes byte-identical everywhere, so LOVE lands at one address on every chain regardless of where local wETH sits.

Out of scope, and deliberately so: the note's multisig/timelock allowlist governance and its bonded provisional path for novel chains. Both reintroduce the admin key LOVE does not have. A compile-time allowlist is append-only by construction and ownerless; on a chain with unrecognized wETH bytecode, registration reverts.

Done when: the registry rejects unknown bytecode and non-wETH addresses, Love derives to the same address on two anvil nodes whose wETH sits at different addresses, and forge test and forge fmt --check pass.

Verify wETH by bytecode and deploy at one address on every chain #5