# Self-referential identity as authorization

Auth checks where the trusted identity can be the contract itself or a shared helper

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-09-15. Updated 2026-10-25._

## How it works
An access check compares the caller or target against an address the contract already trusts, but that address can be made to equal the contract itself or a shared helper. The assumption that "only trusted code reaches this point" breaks because the contract can call itself, own itself, or be registered as its own owner. The check passes while the real caller is untrusted.

## Where it shows up
- Multicall or router logic that authorizes by target address and treats `target == address(this)` as trusted [E1](https://bugbountylibrary.com/r/dhl%3A20260915-rsethsafemodule.md)
- Ownership or `isOwner` checks where the contract can be set as its own owner [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md)
- Shared proxy-action libraries registered as vault/SAFE owner instead of per-user proxies [E3](https://bugbountylibrary.com/r/dhl%3A20260901-reflexergeb.md)
- Public, unauthenticated functions whose only gate is `msg.sender` matching the registered owner, where that owner is the shared library itself [E3](https://bugbountylibrary.com/r/dhl%3A20260901-reflexergeb.md)
- Flash-action hooks that let a creditor execute arbitrary actions, including asset transfers [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md)

## How to review
Trace every authorization decision to its source of identity. The invariant: an authorization check must bind to an identity that cannot be the contract, a shared library, or an attacker-controlled wrapper. Concretely:
- For each `msg.sender`/target check, ask whether that value can equal `address(this)` or a shared helper, and whether that path is intended.
- Confirm self-calls and self-ownership are rejected or explicitly safe.
- For proxy-action libraries, verify each vault owner is a per-user proxy, never the shared library [E3](https://bugbountylibrary.com/r/dhl%3A20260901-reflexergeb.md).
- For flash/arbitrary-call hooks, confirm asset transfers update accounting and cannot move collateral out [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md).

## Variants seen
- Router self-call laundering an untrusted payload into an enabled Safe module, then DELEGATECALL [E1](https://bugbountylibrary.com/r/dhl%3A20260915-rsethsafemodule.md)
- Account as its own owner plus malicious creditor executing `_transferFromOwner` without updating stored collateral [E2](https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md)
- Shared library as SAFE owner with unauthenticated `quitSystem` passing `safeAllowed` via `msg.sender` [E3](https://bugbountylibrary.com/r/dhl%3A20260901-reflexergeb.md)

## Impact and severity
High to critical: direct asset drains. E1 drained 2,900 aEthrsETH; E3 drained ~5.94 ETH across four SAFEs; E2 could enable uncollateralized loans. Severity is highest when the trusted identity is a shared component (library, module, router) reachable by anyone, and when downstream contracts trust that identity without re-checking the true caller.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260915-rsethsafemodule.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260901-reflexergeb.md