# No exit path after shutdown

Check every refund, withdraw, or downgrade path still works once a lifecycle state closes.

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-04-22. Updated 2026-10-23._

## How it works
A contract enters a terminal state (auction concluded, external pool shut down, governance timelock holding ETH) and the only function that could move assets out is gated on the state being active. The assumption that "the exit path is always available" breaks because the exit is guarded by the same lifecycle flag that just flipped. Assets remain in the contract with no reachable code path to release them.

## Where it shows up
- A single withdrawal/refund/cancel function whose guard reverts once a state is `concluded`, `closed`, or `shutdown`.
- Prefunded or escrowed models where seller funds sit in the contract before settlement.
- Deposit adapters that call an external staking/booster contract unconditionally, with no admin path to downgrade to plain-token mode.
- Governance `execute` that is non-payable while proposals carry ETH values, so timelock-held ETH cannot be paid out.
- Any admin "reset" or "downgrade" function that is missing for a configurable external dependency.

## How to review
For each terminal state, enumerate every asset the contract can hold and confirm a reachable function releases it after the state is entered. The invariant: for every lifecycle state S and every asset A the contract may custody in S, there exists a callable path (by user or admin) that transfers A out. Check that refund/withdraw guards do not depend on the same flag that closes the state. For adapters, confirm an admin escape hatch exists to switch off the external dependency. For governance, confirm `execute` is payable and forwards `values`.

## Variants seen
- Auction: `cancelAuction` reverts via `_revertIfLotConcluded`; unsold prefunded base tokens stuck after conclusion [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md).
- Collateral adapter: `depositERC20` unconditionally calls `Booster.deposit`; no downgrade when pool shut down, bricking deposits [E2](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-03.md).
- Governance: non-payable `execute` cannot forward ETH from Timelock, locking funds [E3](https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03.md).

## Impact and severity
Permanent lock of user or protocol funds (E1, E3) or permanent loss of a collateral/deposit capability (E2). Severity rises with the value stranded and when no admin recovery exists; partial-fill auctions and ETH-holding timelocks make it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03.md