# AmbireAccount implementation can be destroyed by privileges

AmbireAccount reference implementation's constructor grants privileges that can selfdestruct the logic contract, bricking every proxy wallet pointing at it.

- Payout: Audit contest
- Severity: medium
- Program: Ambire
- Found by: adriro
- Disclosed: 2023-08-04
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-05-ambire#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ambire%3AM-05
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AmbireAccount implementation contract / ERC1967 proxy wallets
**Root cause:** The AmbireAccount constructor writes privileges into the reference implementation's storage; any such privilege can set a fallback handler and selfdestruct the implementation, leaving all proxies without logic code.
**Steps:**
1. Deployer deploys `new AmbireAccount(addrsImpl)` with itself as privilege.
2. User deploys `AccountProxy(addrsWallet, address(implementation))` pointing at that implementation.
3. Privileged deployer calls `implementation.executeBySender(txns)` with `txns[0].data = abi.encodeWithSelector(AmbireAccount.setAddrPrivilege.selector, address(0x6969), bytes32(uint256(uint160(address(destroyer)))))`.
4. Deployer calls `Destroyer(address(implementation)).destruct()` which runs `selfdestruct(payable(address(0)))`.
5. Implementation code length becomes 0; every proxy wallet is bricked.
**How found:** Code review of the AmbireAccount constructor: noticed privileges are set on the reference implementation itself, then reasoned that a privilege could install a selfdestruct fallback and destroy the shared logic contract.
**Exploitation:** A malicious deployer (or any address granted privilege via the constructor) sets a fallback handler on the implementation, then triggers selfdestruct, wiping the logic contract so all proxies become non-functional and funds inaccessible.
**Escalation:** Single destroyed implementation bricks every wallet deployed as a proxy over it; CREATE2 redeploy only mitigates, and enables blackmail per judge.
**Insight:** When auditing proxy/implementation patterns, check whether the implementation contract's own constructor or initializer grants any privileged role — a privilege on the shared logic contract is a kill switch for every proxy pointing at it.