Empirical Analysis of Smart Contract Factories on EVM-Compatible Chains

Abstract

Decentralized applications on EVM-compatible blockchains are powered by smart contracts—reprogrammable logic deployed on-chain. Among them, smart contract factories represent a distinct class of contracts that automate the creation of other contracts through CREATE / CREATE2 , enabling scalable and repeatable deployments of tokens, protocol modules, and NFT collections. Factories are now the dominant vehicle for contract deployment and mint the majority of contracts. Yet, the ecosystem still lacks (i) a global view of their prevalence and application domains, (ii) a catalog of implementation families beyond upgradeable proxies, and (iii) guidance on factory-specific security pitfalls that ripple across deployment pipelines. To address these gaps, we present the first ecosystem-scale measurement of factory activity on two EVM-compatible chains: Ethereum and Polygon. We implement a bytecode-based factory contract detector that disassembles 434 million deployed runtimes, builds control-flow graphs, and uses reachability analysis to confirm on-path CREATE / CREATE2 operations. This yields 120,204 Ethereum factories and 69,258 Polygon factories. The resulting dataset enables three key findings: (i) longitudinal measurements show factories have minted over 90% of contracts since 2020, concentrated in a small cadre of high-volume deployers; (ii) clustering 3,000 verified factories reveals four dominant application domains spanning Finance & token, Infrastructure & Protocol, Proxy & upgrade, and NFT & creator use cases; and (iii) semantic inspection distills six recurring implementation patterns alongside factory-specific attack vectors and security issues. Altogether, these results contribute to a deeper understanding of the current status, implementation patterns, and security issues of factory-based deployments.