SELFDESTRUCT reachable from non-admin path
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor detects whether any deployed contract in the protocol contains the SELFDESTRUCT opcode in a code path reachable from a non-admin, publicly callable function. The assessment is purely static: a bytecode scan for SELFDESTRUCT combined with call-graph analysis to determine whether the path is gated by an admin-only access control check. Contracts where SELFDESTRUCT is only reachable via owner or multisig-protected functions are not flagged.
**Why it matters** SELFDESTRUCT in an implementation contract reachable from a public path allows an attacker to destroy the implementation, bricking every proxy that points to it. The Parity wallet freeze (not in dataset but foundational) occurred because the initWallet() function on the library implementation had no access control, allowing any caller to claim ownership and then call kill(), permanently destroying the implementation and making $150M of funds irretrievable. Post-Dencun, the SELFDESTRUCT opcode behavior changed in EVM (it no longer destroys code but still clears ETH balance), but the pattern remains dangerous on non-EVM chains or in legacy contracts.
**Green / Yellow / Red** Green: no SELFDESTRUCT opcode is present in any deployed contract, or SELFDESTRUCT is present only in code paths exclusively gated by owner or multisig access control with a timelock. Yellow: SELFDESTRUCT is present behind an admin gate but the admin gate does not require a timelock, meaning a compromised admin key could brick the protocol instantly. Red: SELFDESTRUCT is present in a code path reachable from any external caller without access control.
**Common gray cases** This factor cannot be graded when source is not verified and bytecode disassembly is ambiguous about the opcode's reachability conditions.
**Notable historical examples** The Parity wallet freeze ($150M locked permanently, 2017) is the foundational historical reference for this attack class.
Measurement what to look for #
Determine whether any deployed contract contains the SELFDESTRUCT opcode in a code path reachable from a non-admin caller.