Access control vulnerability

Smart contracts usually reserve some functions for an owner, an admin role or another contract: minting tokens, changing parameters, upgrading the code, pausing or moving treasury funds. Access control is the logic that checks who is calling. A missing modifier, a wrong role check, an initializer that anyone can call, or a function that trusts arbitrary input about who is authorised are enough to hand those powers to an attacker.

These are among the most damaging and frequent causes of losses in DeFi. In 2017, a user triggered an unprotected initialization function in the Parity multisig library, became its owner and destroyed it, freezing hundreds of thousands of ETH. The 2021 Poly Network exploit came from a cross-chain function that let the attacker replace the bridge's keepers. Industry security reports regularly rank access-control failures among the top loss categories.

The term also covers off-chain failures in how privileged keys are held, such as an admin key on a hot server. Audits, role-based libraries, two-step ownership transfers, timelocks and multisig owners reduce the risk, but every privileged role is still a target.