@safe-vanity-blockie/safe-config 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 safe-vanity-blockie contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,41 @@
+# @safe-vanity-blockie/safe-config
+
+Resolves the canonical Safe contract addresses for a chain and turns a Safe setup (owners,
+threshold, version) into the initializer and `saltNonce` inputs that
+[`@safe-vanity-blockie/core`](https://www.npmjs.com/package/@safe-vanity-blockie/core) needs to
+derive a counterfactual address.
+
+Unlike `core`, this package talks to a chain: it reads the chain ID from an RPC endpoint once, then
+looks up the proxy factory and singleton deployed there.
+
+## Install
+
+Requires Node.js >= 22.
+
+```
+npm install @safe-vanity-blockie/safe-config
+```
+
+## Exports
+
+| Export | Purpose |
+| --- | --- |
+| `loadSafeConstants` | resolve proxy factory, singleton and init code hash for a chain |
+| `verifyWithProtocolKit` | cross-check a derived address against the official Safe Protocol Kit |
+| `ZKSYNC_CHAIN_IDS` | chains whose CREATE2 derivation differs, so an address is not portable |
+| `SafeSetup`, `SetupInput` | the setup shape and its input form |
+
+`verifyWithProtocolKit` exists because deriving an address yourself is only trustworthy if it agrees
+with the reference implementation. The CLI and the web app both run it before showing a result.
+
+## zkSync
+
+zkSync-family chains use a different CREATE2 scheme, so an address mined for one of them is **not**
+the same on other chains. `ZKSYNC_CHAIN_IDS` is how callers detect that case and say so.
+
+## Links
+
+- [Repository](https://github.com/tmjssz/safe-vanity-blockie)
+- [`safe-vanity-blockie`](https://www.npmjs.com/package/safe-vanity-blockie) — the CLI
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { loadSafeConstants, type SafeSetup, type SetupInput, verifyWithProtocolKit, ZKSYNC_CHAIN_IDS, } from './setup.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { loadSafeConstants, verifyWithProtocolKit, ZKSYNC_CHAIN_IDS, } from './setup.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAGjB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,YAAY,CAAA"}

package/dist/setup.d.ts

@@ -0,0 +1,45 @@
+import { SafeProvider } from '@safe-global/protocol-kit';
+import type { SafeVersion } from '@safe-global/types-kit';
+import { type SafeConstants } from '@safe-vanity-blockie/core';
+import { type Hex } from 'viem';
+export interface SetupInput {
+    rpcUrl: string;
+    owners: string[];
+    threshold: number;
+    safeVersion: SafeVersion;
+    /** Force the L1 singleton on an L2 chain. Must match what deployment will use. */
+    isL1SafeSingleton?: boolean;
+}
+export interface SafeSetup {
+    chainId: bigint;
+    constants: SafeConstants;
+    constantsHex: {
+        initializerHash: Hex;
+        factory: Hex;
+        initCodeHash: Hex;
+    };
+    safeProvider: SafeProvider;
+    safeAccountConfig: {
+        owners: string[];
+        threshold: number;
+    };
+    safeVersion: SafeVersion;
+    isL1SafeSingleton?: boolean;
+}
+/**
+ * zkSync Era and friends derive CREATE2 addresses with a different formula (spec §3.1).
+ * These are the chain IDs protocol-kit itself gates its zkSync formula on internally
+ * (ZKSYNC_MAINNET = 324, ZKSYNC_TESTNET = 300, ZKSYNC_LENS = 232), per the installed
+ * @safe-global/protocol-kit@8.0.5 source. protocol-kit additionally gates on
+ * `safeVersion <= 1.4.1`, which covers every version this CLI supports (1.4.1 and 1.3.0),
+ * so a plain set membership check on chain ID is sufficient here.
+ */
+export declare const ZKSYNC_CHAIN_IDS: ReadonlySet<bigint>;
+/**
+ * Reads chainId and the three constants that stay fixed for a given
+ * (owners, threshold, safeVersion). Runs once on the main thread; workers get plain hex.
+ */
+export declare function loadSafeConstants(input: SetupInput): Promise<SafeSetup>;
+/** Cross-checks one mined result against protocol-kit. Run this every session (spec §11). */
+export declare function verifyWithProtocolKit(setup: SafeSetup, saltNonce: string, address: string): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,YAAY,EACb,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAU,KAAK,GAAG,EAAa,MAAM,MAAM,CAAA;AAElD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,WAAW,CAAA;IACxB,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,aAAa,CAAA;IACxB,YAAY,EAAE;QAAE,eAAe,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,GAAG,CAAC;QAAC,YAAY,EAAE,GAAG,CAAA;KAAE,CAAA;IACvE,YAAY,EAAE,YAAY,CAAA;IAC1B,iBAAiB,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,WAAW,EAAE,WAAW,CAAA;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAA;AAEhF;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAkD7E;AAED,6FAA6F;AAC7F,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,SAAS,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/setup.js

@@ -0,0 +1,74 @@
+import { encodeSetupCallData, getSafeContract, getSafeProxyFactoryContract, predictSafeAddress, SafeProvider, } from '@safe-global/protocol-kit';
+import { hexToBytes } from '@safe-vanity-blockie/core';
+import { concat, keccak256 } from 'viem';
+/**
+ * zkSync Era and friends derive CREATE2 addresses with a different formula (spec §3.1).
+ * These are the chain IDs protocol-kit itself gates its zkSync formula on internally
+ * (ZKSYNC_MAINNET = 324, ZKSYNC_TESTNET = 300, ZKSYNC_LENS = 232), per the installed
+ * @safe-global/protocol-kit@8.0.5 source. protocol-kit additionally gates on
+ * `safeVersion <= 1.4.1`, which covers every version this CLI supports (1.4.1 and 1.3.0),
+ * so a plain set membership check on chain ID is sufficient here.
+ */
+export const ZKSYNC_CHAIN_IDS = new Set([324n, 300n, 232n]);
+/**
+ * Reads chainId and the three constants that stay fixed for a given
+ * (owners, threshold, safeVersion). Runs once on the main thread; workers get plain hex.
+ */
+export async function loadSafeConstants(input) {
+    const safeProvider = new SafeProvider({ provider: input.rpcUrl });
+    const chainId = await safeProvider.getChainId();
+    if (ZKSYNC_CHAIN_IDS.has(chainId)) {
+        throw new Error(`chain ${chainId} is zkSync-based and derives contract addresses with a different formula; ` +
+            'this tool would predict the wrong address. Use a standard EVM chain.');
+    }
+    const safeAccountConfig = { owners: input.owners, threshold: input.threshold };
+    const factoryContract = await getSafeProxyFactoryContract({
+        safeProvider,
+        safeVersion: input.safeVersion,
+    });
+    const safeContract = await getSafeContract({
+        safeProvider,
+        safeVersion: input.safeVersion,
+        isL1SafeSingleton: input.isL1SafeSingleton,
+    });
+    const initializer = await encodeSetupCallData({
+        safeProvider,
+        safeAccountConfig,
+        safeContract,
+        customSafeVersion: input.safeVersion,
+    });
+    const initializerHash = keccak256(initializer);
+    // proxyCreationCode() returns a single-element tuple, not a bare string.
+    const [proxyCreationCode] = await factoryContract.proxyCreationCode();
+    const encodedSingleton = safeProvider.encodeParameters('address', [safeContract.getAddress()]);
+    const initCodeHash = keccak256(concat([proxyCreationCode, encodedSingleton]));
+    const factory = factoryContract.getAddress();
+    return {
+        chainId,
+        constants: {
+            initializerHash: hexToBytes(initializerHash),
+            factory: hexToBytes(factory),
+            initCodeHash: hexToBytes(initCodeHash),
+        },
+        constantsHex: { initializerHash, factory, initCodeHash },
+        safeProvider,
+        safeAccountConfig,
+        safeVersion: input.safeVersion,
+        isL1SafeSingleton: input.isL1SafeSingleton,
+    };
+}
+/** Cross-checks one mined result against protocol-kit. Run this every session (spec §11). */
+export async function verifyWithProtocolKit(setup, saltNonce, address) {
+    const predicted = await predictSafeAddress({
+        safeProvider: setup.safeProvider,
+        chainId: setup.chainId,
+        safeAccountConfig: setup.safeAccountConfig,
+        safeDeploymentConfig: { saltNonce, safeVersion: setup.safeVersion },
+        isL1SafeSingleton: setup.isL1SafeSingleton,
+    });
+    if (predicted.toLowerCase() !== address.toLowerCase()) {
+        throw new Error(`self-check failed for saltNonce ${saltNonce}: fast derivation gave ${address}, ` +
+            `protocol-kit predictSafeAddress gave ${predicted.toLowerCase()}`);
+    }
+}
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,2BAA2B,EAC3B,kBAAkB,EAClB,YAAY,GACb,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,UAAU,EAAsB,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAY,SAAS,EAAE,MAAM,MAAM,CAAA;AAqBlD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAiB;IACvD,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAA;IAE/C,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,4EAA4E;YAC1F,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;IAE9E,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC;QACxD,YAAY;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;QACzC,YAAY;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC5C,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,iBAAiB,EAAE,KAAK,CAAC,WAAW;KACrC,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,SAAS,CAAC,WAAkB,CAAC,CAAA;IAErD,yEAAyE;IACzE,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM,eAAe,CAAC,iBAAiB,EAAE,CAAA;IACrE,MAAM,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IAC9F,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,iBAAwB,EAAE,gBAAuB,CAAC,CAAC,CAAC,CAAA;IAC3F,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAS,CAAA;IAEnD,OAAO;QACL,OAAO;QACP,SAAS,EAAE;YACT,eAAe,EAAE,UAAU,CAAC,eAAe,CAAC;YAC5C,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;YAC5B,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC;SACvC;QACD,YAAY,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE;QACxD,YAAY;QACZ,iBAAiB;QACjB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAA;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB,EAChB,SAAiB,EACjB,OAAe;IAEf,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,oBAAoB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;QACnE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,0BAA0B,OAAO,IAAI;YAC/E,wCAAwC,SAAS,CAAC,WAAW,EAAE,EAAE,CACpE,CAAA;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@safe-vanity-blockie/safe-config",
+  "version": "0.3.0",
+  "description": "Resolve canonical Safe contract addresses and build the setup inputs for counterfactual address derivation",
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tmjssz/safe-vanity-blockie.git",
+    "directory": "packages/safe-config"
+  },
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "safe",
+    "safe-global",
+    "create2",
+    "counterfactual",
+    "protocol-kit",
+    "ethereum",
+    "zksync"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@safe-global/protocol-kit": "^8.0.5",
+    "@safe-global/types-kit": "^4.0.1",
+    "viem": "^2.55.11",
+    "@safe-vanity-blockie/core": "0.3.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "test:network": "vitest run --config vitest.network.config.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+export {
+  loadSafeConstants,
+  type SafeSetup,
+  type SetupInput,
+  verifyWithProtocolKit,
+  ZKSYNC_CHAIN_IDS,
+} from './setup.js'

package/src/setup.ts

@@ -0,0 +1,116 @@
+import {
+  encodeSetupCallData,
+  getSafeContract,
+  getSafeProxyFactoryContract,
+  predictSafeAddress,
+  SafeProvider,
+} from '@safe-global/protocol-kit'
+import type { SafeVersion } from '@safe-global/types-kit'
+import { hexToBytes, type SafeConstants } from '@safe-vanity-blockie/core'
+import { concat, type Hex, keccak256 } from 'viem'
+
+export interface SetupInput {
+  rpcUrl: string
+  owners: string[]
+  threshold: number
+  safeVersion: SafeVersion
+  /** Force the L1 singleton on an L2 chain. Must match what deployment will use. */
+  isL1SafeSingleton?: boolean
+}
+
+export interface SafeSetup {
+  chainId: bigint
+  constants: SafeConstants
+  constantsHex: { initializerHash: Hex; factory: Hex; initCodeHash: Hex }
+  safeProvider: SafeProvider
+  safeAccountConfig: { owners: string[]; threshold: number }
+  safeVersion: SafeVersion
+  isL1SafeSingleton?: boolean
+}
+
+/**
+ * zkSync Era and friends derive CREATE2 addresses with a different formula (spec §3.1).
+ * These are the chain IDs protocol-kit itself gates its zkSync formula on internally
+ * (ZKSYNC_MAINNET = 324, ZKSYNC_TESTNET = 300, ZKSYNC_LENS = 232), per the installed
+ * @safe-global/protocol-kit@8.0.5 source. protocol-kit additionally gates on
+ * `safeVersion <= 1.4.1`, which covers every version this CLI supports (1.4.1 and 1.3.0),
+ * so a plain set membership check on chain ID is sufficient here.
+ */
+export const ZKSYNC_CHAIN_IDS: ReadonlySet<bigint> = new Set([324n, 300n, 232n])
+
+/**
+ * Reads chainId and the three constants that stay fixed for a given
+ * (owners, threshold, safeVersion). Runs once on the main thread; workers get plain hex.
+ */
+export async function loadSafeConstants(input: SetupInput): Promise<SafeSetup> {
+  const safeProvider = new SafeProvider({ provider: input.rpcUrl })
+  const chainId = await safeProvider.getChainId()
+
+  if (ZKSYNC_CHAIN_IDS.has(chainId)) {
+    throw new Error(
+      `chain ${chainId} is zkSync-based and derives contract addresses with a different formula; ` +
+        'this tool would predict the wrong address. Use a standard EVM chain.',
+    )
+  }
+
+  const safeAccountConfig = { owners: input.owners, threshold: input.threshold }
+
+  const factoryContract = await getSafeProxyFactoryContract({
+    safeProvider,
+    safeVersion: input.safeVersion,
+  })
+  const safeContract = await getSafeContract({
+    safeProvider,
+    safeVersion: input.safeVersion,
+    isL1SafeSingleton: input.isL1SafeSingleton,
+  })
+
+  const initializer = await encodeSetupCallData({
+    safeProvider,
+    safeAccountConfig,
+    safeContract,
+    customSafeVersion: input.safeVersion,
+  })
+  const initializerHash = keccak256(initializer as Hex)
+
+  // proxyCreationCode() returns a single-element tuple, not a bare string.
+  const [proxyCreationCode] = await factoryContract.proxyCreationCode()
+  const encodedSingleton = safeProvider.encodeParameters('address', [safeContract.getAddress()])
+  const initCodeHash = keccak256(concat([proxyCreationCode as Hex, encodedSingleton as Hex]))
+  const factory = factoryContract.getAddress() as Hex
+
+  return {
+    chainId,
+    constants: {
+      initializerHash: hexToBytes(initializerHash),
+      factory: hexToBytes(factory),
+      initCodeHash: hexToBytes(initCodeHash),
+    },
+    constantsHex: { initializerHash, factory, initCodeHash },
+    safeProvider,
+    safeAccountConfig,
+    safeVersion: input.safeVersion,
+    isL1SafeSingleton: input.isL1SafeSingleton,
+  }
+}
+
+/** Cross-checks one mined result against protocol-kit. Run this every session (spec §11). */
+export async function verifyWithProtocolKit(
+  setup: SafeSetup,
+  saltNonce: string,
+  address: string,
+): Promise<void> {
+  const predicted = await predictSafeAddress({
+    safeProvider: setup.safeProvider,
+    chainId: setup.chainId,
+    safeAccountConfig: setup.safeAccountConfig,
+    safeDeploymentConfig: { saltNonce, safeVersion: setup.safeVersion },
+    isL1SafeSingleton: setup.isL1SafeSingleton,
+  })
+  if (predicted.toLowerCase() !== address.toLowerCase()) {
+    throw new Error(
+      `self-check failed for saltNonce ${saltNonce}: fast derivation gave ${address}, ` +
+        `protocol-kit predictSafeAddress gave ${predicted.toLowerCase()}`,
+    )
+  }
+}