Submitted by berndartmueller, also found by givn
https://github.com/initia-labs/minievm/blob/744563dc6a642f054b4543db008df22664e4c125/x/evm/keeper/context.go#L388-L401
The Create and Create2 message handlers check the sender is allowed to deploy a contract by calling assertAllowedPublishers(..) here and here.
The deployers can either be restricted to specific addresses (params.AllowedPublishers) or completely unrestricted so that anyone can deploy a contract.
However, if the deployers are restricted, a permissioned deployer can deploy a factory contract that can then be used by anyone to deploy arbitrary contracts, bypassing the restriction and potentially leading to malicious contracts being deployed.
This is contrary to Evmos which does check also the EVM create opcode if the address is allowed to deploy a contract. It adds a special create hook, which checks if the caller is permissioned to deploy a contract.
This hook is called by EVM::Create and EVM::Create2, which are called when the EVM encounters the CREATE and CREATE2 opcodes.
This shows that contract deployment can be fully restricted if desired.
EVMCreateWithTracer() internally calls the EVMs Create or Create2 functions, which contain the standard implementation without any deployment restriction, found here.
Consider using a similar approach to Evmos whereby the Create and Create2 are intercepted and the caller is checked for permission to deploy a contract.
leojin (Initia) disputed and commented via duplicate issue S-161:
