SELFDESTRUCT reachable from non-admin path
Wormhole's assessment for RD-F-011 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
The 2022 Immunefi uninitialized proxy disclosure described a scenario where an attacker could trigger selfdestruct via: (1) call `initialize()` to take over Guardian set, (2) deploy malicious contract with SELFDESTRUCT, (3) submit governance upgrade to that address. This was an indirect path gated behind taking over the Guardian set first — it required exploiting the uninitialized state as a prerequisite. The fix (properly initializing) was applied before exploit. Current deployed code: Gover...
Sources #
- Curator noteExtracted from 01-code-security.md — RD-F-011 finding; no URL cited in originalretrieved 2026-04-28
Methodology #
Determine whether any deployed contract contains the SELFDESTRUCT opcode in a code path reachable from a non-admin caller.
See the full factor methodology and distribution across all protocols →