# Unprotected privileged setter repoints trust

Public setters for owner, router, oracle, forwarder, or Merkle root that anyone can call to repoint trust

_Area: Smart contract access control and control flow. Seen in 25 disclosed reports; latest 2026-04-12. Updated 2026-10-23._

## How it works
A contract stores a reference (owner, router, oracle, forwarder, manager, Merkle root) or a parameter (multiplier, burn rate, delay) and later trusts it for authorization, pricing, or reward math. The setter that writes it lacks a real access-control modifier, so any caller can change it. Downstream logic then treats the attacker's contract or value as the trusted party. The broken assumption: only an authorized role can change trust anchors. Two shapes: a missing modifier (any caller) or a weak one (a role that can rewrite its own trust boundary).

## Where it shows up
- Public setters for router, pair, forwarder, oracle, manager, or Merkle root, with the intended `onlyOwner` present only as a comment [E3](https://bugbountylibrary.com/r/dhl%3A20250427-bitdog.md).
- Upgradeable proxy contracts registering dependency addresses that downstream contracts trust for auth [E1](https://bugbountylibrary.com/r/dhl%3A20260412-subquerysettings.md).
- Fee/accounting contracts whose setter swaps a trusted external contract reference used in balance math [E8](https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AH-04.md).
- Reward or time parameters (fixed-day, burn rate, ratios) settable by anyone [E6](https://bugbountylibrary.com/r/dhl%3A20250823-abccapp.md)[E7](https://bugbountylibrary.com/r/dhl%3A20250404-airwa.md).
- Token setters for a router that gates `onlyRouter` mint/burn [E5](https://bugbountylibrary.com/r/dhl%3A20231129-ais.md).
- Timelock/admin functions where the privileged role can rewrite its own role or the delay directly [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01.md).

## How to review
Grep every state-mutating function that writes an address or a parameter consumed by authorization, pricing, or reward math. Confirm a real modifier (not a comment) restricts it to the intended role. Trace each stored address to its consumers; if a consumer uses it for identity, approval, mint/burn, or swap routing, the setter must be gated. For parameter setters, trace the value into reward or fee math and check for bounds. The invariant: no caller outside the authorized role can change any value another function trusts for access decisions or fund movement. For admin/timelock contracts, require `msg.sender == address(this)` on self-referential setters. For proxies, check storage layout for collisions when adding these setters.

## Variants seen
- Unprotected dependency registration in a proxy, enabling impersonation of core roles [E1](https://bugbountylibrary.com/r/dhl%3A20260412-subquerysettings.md).
- Public Merkle root update (a value, not an address) allowing fake claims [E2](https://bugbountylibrary.com/r/dhl%3A20250728-superrare.md).
- Public router setter guarded only by a comment [E3](https://bugbountylibrary.com/r/dhl%3A20250427-bitdog.md).
- Governor can swap itself and zero the delay, bypassing the timelock [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01.md).
- Public router setter collapsing an `onlyRouter` mint/burn boundary [E5](https://bugbountylibrary.com/r/dhl%3A20231129-ais.md).
- Unprotected reward multiplier setter amplifying claims [E6](https://bugbountylibrary.com/r/dhl%3A20250823-abccapp.md).
- Unprotected burn-rate setter skewing LP pricing [E7](https://bugbountylibrary.com/r/dhl%3A20250404-airwa.md).
- Public `setCurves` repointing a fee-calculation reference [E8](https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AH-04.md).

## Impact and severity
Drains ranged from ~$10.1K [E6](https://bugbountylibrary.com/r/dhl%3A20250823-abccapp.md) to 218M SQT [E1](https://bugbountylibrary.com/r/dhl%3A20260412-subquerysettings.md), 11.9M RARE [E2](https://bugbountylibrary.com/r/dhl%3A20250728-superrare.md), and ~56.73 BNB [E7](https://bugbountylibrary.com/r/dhl%3A20250404-airwa.md). Severity is critical when the repointed address gates fund movement or reward claims. It worsens when downstream contracts trust the address for authorization [E1](https://bugbountylibrary.com/r/dhl%3A20260412-subquerysettings.md), when no timelock or cap limits the parameter [E4](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01.md), and when a single transaction suffices.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260412-subquerysettings.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250728-superrare.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250427-bitdog.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-01.md
- E5: https://bugbountylibrary.com/r/dhl%3A20231129-ais.md
- E6: https://bugbountylibrary.com/r/dhl%3A20250823-abccapp.md
- E7: https://bugbountylibrary.com/r/dhl%3A20250404-airwa.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AH-04.md