Skip to content
THREATWIRE

DeFi Security · Vulnerability class

Access control and caller trust

A function that moves value trusts a caller, a forwarded sender or a self-declared identity that it should have verified.

DatabaseIncidentsChainsProtocolsVulnerabilities

The concept

Authentication has to rest on something the caller cannot fake. Asking the caller who it is, or trusting a sender address passed in by a forwarder, hands control to whoever can imitate the answer.

Defensive lessons

  • Authenticate against addresses you control, never against the caller's own answer.
  • Validate forwarded senders cryptographically.
  • Do not let callers choose call targets and call data.
  • Revoke old approvals and expire permissions.

Stored incidents