# Stale proxy and address references

Stored contract pointers trusted after the target is destroyed, swapped, or upgraded

_Area: Smart contract access control and control flow. Seen in 6 disclosed reports; latest 2025-02-18. Updated 2026-10-23._

## How it works
A contract stores a pointer (an address, a mapping entry, or an index) to another contract and later trusts it without confirming the target still exists, still holds the relevant state, or is still the intended target. When the target is destroyed, swapped, upgraded, or replaced, the pointer goes stale. Calls then revert, hit a fallback returning zero, or reach a new contract that never held the old state. The broken assumption: a stored reference stays valid and authoritative for the lifetime of the data it governs.

## Where it shows up
- Mutable single-address fields (marketplace, escrow, module, registry) that admins can rotate while user state lives under the old address.
- Registry mappings that cache proxy addresses and call methods on them without checking `code.length`.
- Upgrade routines that reinitialize modules but skip migrating escrowed assets or per-user state.
- Proofs or records bound to an index into a mutable oracle that can delete or replace entries.
- Permission getters with a zero-value fallback, where deleting a mapping entry silently changes who passes the check.
- Adjacent (not the same pattern): array `pop` without zeroing the vacated slot; interface drift where a called member is missing on the deployed version.

## How to review
For every stored reference, ask: what happens to data created under the old target when this pointer changes or the target dies? The invariant: any state or asset reachable only through a pointer must remain reachable after that pointer is rotated, destroyed, or upgraded. Checklist:
- Withdrawal/exit paths resolve the pointer to where assets actually sit.
- Existence checks (`code.length`) precede method calls on cached addresses.
- Upgrade paths migrate custody and per-user state.
- Proofs can be re-proven against the current oracle entry, not a pinned index.
- Getters with fallbacks: trace every path that zeroes the underlying mapping.
- Grep for mutable address setters, `code.length` checks, and owner-fallback getters.

## Variants seen
- Module upgrade orphans escrowed rentals, blocking stopRent [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-07.md).
- Escrow pointer swapped mid-period strands escrowed tokens; withdrawal is DAO-gated [E2](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AM-02.md).
- Marketplace rotation orphans listings, locking vested tokens; freeze blocks unlist [E6](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-13.md).
- Same-index reproof guard orphans withdrawals after root replacement [E4](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-13.md).
- Stale destroyed proxy blocks redeployment; no `code.length` check [E5](https://bugbountylibrary.com/r/c4%3A2022-08-mimo%3AM-08.md).
- Admin removal zeroes owner mapping; fallback lets wrong caller pass [E7](https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-10.md).

## Impact and severity
Locked funds and stranded user assets recur across evidence [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-07.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AM-02.md)[E6](https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-13.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-13.md)[E7](https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-10.md); redeploy lockout in [E5](https://bugbountylibrary.com/r/c4%3A2022-08-mimo%3AM-08.md). Severity rises when no admin escape hatch or migration path exists and users cannot self-recover from the stale target.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-07.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AM-02.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AM-1.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-13.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-08-mimo%3AM-08.md
- E6: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-13.md
- E7: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-10.md