# Missing method or zero return bricks deploy

Calls to methods or return values the target contract may not implement or may return zero

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-06-17. Updated 2026-10-24._

## How it works
Code assumes a target contract exposes a specific method (or returns a meaningful non-zero value) and calls it unconditionally. When the target lacks that member, the call either reverts or silently hits a fallback returning `address(0)`. Either way the calling path is bricked: a shared function that serves several implementations breaks for the ones that don't satisfy the full assumed interface, or a deploy/call path fails against a real deployed version whose ABI differs.

## Where it shows up
- One function used for multiple collateral/asset types, calling a method only some implementations expose (e.g. `vault.oracle()`) [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-05.md)
- Deploy or init code calling a getter (`lp_token()`, `token()`) assumed present on every external contract version [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AM-1.md)
- Integrations passing arguments (payloads) that one router accepts and another rejects [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md)
- Calls whose result is used without checking for zero address or empty return
- Interface chosen by convenience rather than by what the call actually requires [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md)

## How to review
For every external call, confirm the exact target implementation exposes the method and returns a usable value. The invariant: each implementation reachable through a shared code path satisfies the full interface that path assumes, and every return value is validated (non-zero, correct type) before use. Check the deployed ABI of the specific version, not a generic interface. For routers/adapters, verify the chosen contract supports the arguments being passed.

## Variants seen
- Shared withdraw path calls `oracle()` missing on Kerosene vaults, locking deposits [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-05.md)
- Router `swap` rejects non-empty payload; correct contract is a different one lacking other needed methods [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md)
- Newer pool exposes `token()` not `lp_token()`; fallback returns zero, bricking deployment [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AM-1.md)

## Impact and severity
Funds permanently stuck (Kerosene withdrawals impossible) [E1](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-05.md), broken cross-chain rebalancing [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md), and failed vault deployment [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AM-1.md). Severity rises when the broken path is the only exit or the only deploy route, and when the failure is silent (zero return) rather than a loud revert.

## Why fixes fail
Choosing an interface to satisfy one requirement (payload support) can drop another (retryRevert), so a partial swap of contracts leaves the path still broken [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AH-05.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AM-1.md