SELFDESTRUCT reachable from non-admin path

Evidence summary #

GMX v2 uses a re-deploy (non-proxy) model. No SELFDESTRUCT opcode found in ExchangeRouter.sol or Oracle.sol. Post-EIP-6780 (Cancun, March 2024), SELFDESTRUCT only clears ETH balance in same tx unless contract was created in same tx, further limiting residual risk. Non-proxy architecture eliminates the primary SELFDESTRUCT attack vector.

Sources #

Methodology #

Determine whether any deployed contract contains the SELFDESTRUCT opcode in a code path reachable from a non-admin caller.

See the full factor methodology and distribution across all protocols →