CVE-2025-53638: Solady Proxy Initialization Vulnerability

CVE-2025-53638 Overview

CVE-2025-53638 affects Solady, a library that provides gas-optimized Solidity snippets and APIs for Ethereum Virtual Machine (EVM) smart contract development. The flaw exists in versions starting from 0.0.125 and prior to 0.1.24. When an account is deployed through a proxy, calling its initialization function with standard Solidity can silently fail if the initialization function does not return a bool or other return data. The compiler-inserted extcodesize(proxy) check does not detect an empty implementation, allowing the transaction to succeed without initializing the account.

Critical Impact
Silent initialization failures can leave proxy-deployed smart contracts in an uninitialized state, breaking integrity guarantees for downstream logic and asset custody.

Affected Products

Solady versions 0.0.125 through versions prior to 0.1.24
Smart contracts and factories built on affected Solady releases
Proxy-deployed accounts using initialization functions without return data

Discovery Timeline

2025-07-17 - CVE-2025-53638 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53638

Vulnerability Analysis

The vulnerability is classified under [CWE-754] Improper Check for Unusual or Exceptional Conditions. Solady exposes patterns for deploying accounts behind proxies on EVM chains. When a caller invokes an initialization function on a freshly deployed proxy, the Solidity compiler emits an extcodesize check on the proxy address to validate the call target. The check confirms the proxy exists but does not validate the implementation contract to which the proxy delegates.

If the proxy points to an empty implementation, the low-level call returns success with no return data. Solidity treats the call as successful when the initialization function is declared without a return value. The initialization logic never runs, yet the caller receives no error. Downstream systems that depend on the account being initialized inherit an insecure state.

Root Cause

The root cause is an insufficient existence check performed against the proxy rather than the implementation. Solidity's ABI decoding path uses extcodesize(proxy) to decide whether the target contract exists. In proxy architectures, code presence at the proxy address does not guarantee delegate-called logic will execute. When the implementation slot is empty, the delegate call is a no-op that returns success.

Attack Vector

An attacker with network access can trigger deployment of affected implementations on new EVM chains before legitimate deployers do. Redeploying the factory with the same salt on chains where the implementation has not yet been created can produce proxies that silently skip initialization. Downstream applications treating the account as initialized may perform actions with incorrect ownership or configuration assumptions.

Because no verified proof-of-concept code is published, refer to the GitHub Security Advisory GHSA-8xvx-4mvg-m9v8 for the vendor's technical description.

Detection Methods for CVE-2025-53638

Indicators of Compromise

Proxy contracts deployed on new EVM chains where the implementation address contains no bytecode
Initialization transactions that complete successfully but leave state variables such as owner or initialized at their default values
Duplicate proxy addresses created by cross-chain factory redeployment using the same salt

Detection Strategies

Audit on-chain state after deployment to confirm initialization variables are set to expected values rather than zero addresses or default booleans
Review dependency manifests for Solady versions between 0.0.125 and 0.1.23 inclusive
Inspect factory contracts for use of extcodesize-based existence checks without implementation validation

Monitoring Recommendations

Track deployment events for factory contracts across every supported EVM chain and alert on proxies pointing to addresses with zero code size
Instrument post-deployment verification scripts that call view functions on initialized state and fail loudly when defaults are returned
Monitor chain expansion announcements and pre-deploy verified implementations before opening the factory to public use

How to Mitigate CVE-2025-53638

Immediate Actions Required

Upgrade Solady to version 0.1.24 or later in all repositories and rebuild affected contracts
Deploy verified implementations and their factories on every new EVM chain before external users can interact with them
Re-run initialization for any proxy suspected of silent failure and validate on-chain state

Patch Information

The maintainers released the fix in Solady v0.1.24. Consumers should update the dependency, recompile, and redeploy affected factories. The GitHub Security Advisory GHSA-8xvx-4mvg-m9v8 documents the affected version range and remediation guidance.

Workarounds

Declare initialization functions with a return value such as bool so Solidity decodes return data and reverts on empty responses
Wrap initialization calls with an explicit extcodesize check against the implementation address rather than the proxy
Verify initialization state in the same transaction that performs deployment and revert if defaults are observed

bash

# Update Solady dependency to the patched release
forge install Vectorized/solady@v0.1.24
# Or, for npm-based projects
npm install solady@0.1.24