Last updated: March 11, 2025
SCWE-050: Unprotected SELFDESTRUCT Instruction
Stable Version v0.0.1
This content is in the version-(v0.0.1) and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).
Send Feedback
Relationships
Description
The SELFDESTRUCT instruction in Ethereum allows a contract to destroy itself and send its remaining Ether balance to a specified address. If this instruction is not properly protected with access controls, an attacker could trigger it, causing the contract to self-destruct and possibly transferring all the funds to an unauthorized address. This can result in the total loss of funds or disruption of contract functionality.
To mitigate this vulnerability, it is crucial to protect the SELFDESTRUCT instruction with proper access control mechanisms. Only authorized users, such as the contract owner or admin, should be allowed to call the SELFDESTRUCT function. Consider using modifiers like onlyOwner or a role-based access control system to enforce permission checks before allowing this critical operation.
Vulnerable Contract Example
contract Destructible {
address public owner;
constructor() {
owner = msg.sender;
}
// Unprotected SELFDESTRUCT allowing anyone to call it
function destruct() public {
selfdestruct(payable(msg.sender)); // No access control
}
}
Fixed Contract Example
contract Destructible {
address public owner;
modifier onlyOwner() {
require(msg.sender == owner, "Not the owner");
_;
}
constructor() {
owner = msg.sender;
}
// Only the owner can call SELFDESTRUCT
function destruct() public onlyOwner {
selfdestruct(payable(msg.sender)); // Access control added
}
}