Stale-approval exposure on deprecated router
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor counts the number of active user approvals (ERC-20 allowances) granted to contracts that the protocol has officially deprecated — approval slots that remain open on deprecated router or protocol contracts and represent a residual drain vector even after the protocol formally retired those contracts. The count is derived by scanning allowance events against the deprecated contract address set and cross-referencing with the protocol's public deprecation announcements.
Why it matters
Stale user approvals on deprecated contracts are a persistent post-deploy hygiene failure: once a user grants an ERC-20 approval, it remains active indefinitely unless explicitly revoked. When a protocol deprecates a contract without notifying users to revoke approvals, those approvals remain exploitable for as long as the admin keys for the deprecated contract are alive or unchecked. OKX DEX lost $2.7M when a deprecated TokenApprove contract's admin key was compromised — thousands of users had never revoked their approvals because the protocol had not communicated the need to do so. Hacken HAI's $170K loss followed a similar pattern where a decommissioned bridge minter key retained credential authority over contracts that users had not revoked.
Green / Yellow / Red
Green is assigned when the protocol has sent user communications about approval revocation for deprecated contracts, and the count of active approvals to deprecated contracts has fallen to near zero. Yellow covers cases where deprecation was announced but revocation guidance was not prominently communicated, leaving a moderate tail of open approvals. Red is assigned when a protocol has deprecated contracts with material numbers of outstanding user approvals and no revocation guidance or technical enforcement (e.g., a forced-revoke migration) has been deployed.
Common gray cases
This factor is grayed when the protocol has never deprecated any contracts, or when the allowance scanning infrastructure cannot cover the relevant chain within the assessment window.
Notable historical examples
- OKX DEX ($2.7M, 2023): Deprecated TokenApprove contract retained active user approvals; admin key compromise allowed drain of those approvals.
- Hacken ($HAI token) ($170K, 2025): Decommissioned bridge minter key retained authority over approval surfaces that had not been revoked.
Measurement what to look for#
Count the number of active user approvals (ERC-20 `allowance`) to deprecated router or protocol contracts.