PANews reported on March 21 that according to the latest smart contract security audit series of articles released by SlowMist, an attack method that uses CREATE and CREATE2 to achieve "different contracts at the same address" deployment has attracted attention. The attacker first deploys a security contract to obtain authorization, then self-destructs and rebuilds the malicious contract with the same deployment path, inducing the contract to execute malicious logic through delegatecall , which may lead to the hijacking of DAO governance rights. SlowMist recommends that developers record and verify code hashes, use delegatecall prudently, and be wary of the risk of deployment address reuse caused by contract self-destruction.