Selfdestruct Vulnerability

Overview

Selfdestruct Vulnerability is a smart contract weakness created by unsafe assumptions about the EVM SELFDESTRUCT operation, including assumptions about code deletion, forced Ether transfer, contract replacement, or behavior across protocol upgrades. It is not every use of the opcode; the vulnerability exists when security or business logic depends on behavior that is unsafe, deprecated, or version-dependent. It should be interpreted alongside Smart Contract Exploit, which may affect the same workflow without representing the same control, event, or risk.

Contracts may become unusable, balances or invariants may be disrupted, authorization assumptions may fail, and upgrade or redeployment logic may behave unexpectedly.

Organizations should avoid security-critical reliance on SELFDESTRUCT, review target-chain semantics, test against current fork rules, use explicit pause or upgrade controls, and verify migration plans.

Retain compiler and chain versions, bytecode findings, affected functions, exploit scenario, fork assumptions, test transactions, remediation commit, deployment address, and verification result.

Assessment of Selfdestruct Vulnerability should trace a smart contract weakness created by unsafe assumptions about the EVM SELFDESTRUCT operation, including assumptions about code deletion, forced Ether transfer, contract replacement, or behavior across protocol upgrades from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving including assumptions about code deletion, forced Ether transfer, and contract replacement should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Selfdestruct weakness should be tested against the architecture associated with including assumptions about code deletion, forced Ether transfer, and contract replacement.

Retesting for Selfdestruct Vulnerability should reproduce the Selfdestruct weakness involving including assumptions about code deletion, forced Ether transfer, and contract replacement, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.