Losses from create2 wallets that look similar to recently active wallets has surpassed $60m: https://gbhackers.com/create2-bypass-wallet-security-alerts/
Even today I made a transaction, and noticed that create2 contract was deployed which looks very similar to my own wallet. So, clearly the create2 opcode is very useful in this attack pattern as you can cycle through a large number of potential wallets until you find one that looks similar to your target.
Instead of simply getting rid of create2 - what if create2 always returns the same wallet address until it is claimed? This may have to be enforced across all transactions the entire block as simply a recursive call may fool a check that is only scoped to the caller function.
Is this a reasonable patch? or is there a better way of fixing this vulnerably?