SELFDESTRUCT reachable from non-admin path
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor detects whether any deployed contract in the protocol contains the SELFDESTRUCT opcode in a code path reachable from a non-admin, publicly callable function. The assessment is purely static: a bytecode scan for SELFDESTRUCT combined with call-graph analysis to determine whether the path is gated by an admin-only access control check. Contracts where SELFDESTRUCT is only reachable via owner or multisig-protected functions are not flagged.
Why it matters
SELFDESTRUCT in an implementation contract reachable from a public path allows an attacker to destroy the implementation, bricking every proxy that points to it. The Parity wallet freeze (not in dataset but foundational) occurred because the initWallet() function on the library implementation had no access control, allowing any caller to claim ownership and then call kill(), permanently destroying the implementation and making $150M of funds irretrievable. Post-Dencun, the SELFDESTRUCT opcode behavior changed in EVM (it no longer destroys code but still clears ETH balance), but the pattern remains dangerous on non-EVM chains or in legacy contracts.
Green / Yellow / Red
Green: no SELFDESTRUCT opcode is present in any deployed contract, or SELFDESTRUCT is present only in code paths exclusively gated by owner or multisig access control with a timelock. Yellow: SELFDESTRUCT is present behind an admin gate but the admin gate does not require a timelock, meaning a compromised admin key could brick the protocol instantly. Red: SELFDESTRUCT is present in a code path reachable from any external caller without access control.
Common gray cases
This factor cannot be graded when source is not verified and bytecode disassembly is ambiguous about the opcode's reachability conditions.
Notable historical examples
No hacks are currently linked in the database for this specific factor. The factor is retained based on its catastrophic severity class (~5 documented precursor instances in T-01 evidence) and the Parity freeze as a foundational industry reference.
Measurement what to look for#
Determine whether any deployed contract contains the SELFDESTRUCT opcode in a code path reachable from a non-admin caller.