# Unreachable or unimplemented inherited path

Inherited or outside-execution path that skips bookkeeping, is empty, or never runs

_Area: Smart contract access control and control flow. Seen in 11 disclosed reports; one confirmed bounty: $500; latest 2025-10-29. Updated 2026-10-23._

## How it works
A contract inherits or chains into a path that is supposed to do work, but that path is empty, gated to a caller that never calls it, or skips the bookkeeping the rest of the system relies on. The assumption that breaks: that every reachable entry point runs the same complete logic. In practice a base implementation, an override, or an outside-execution hook can be a stub or a fallthrough, so state is never recorded, funds never move, or an asset is routed to the wrong party.

## Where it shows up
- Diamond/mixin inheritance with chained `super` calls where an override falls through to a base that transfers or finalizes unconditionally [E1](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-03.md)[E6](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-13.md).
- A child overrides one half of a pair (e.g. `cancel`) but not the other (`offer`), so creation paths skip the structures the override reads [E5](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-10.md).
- Two-step flows (request/execute) where the second step is gated to a caller that never implements it [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.4.md).
- Empty or unimplemented hooks like `executeTransactionFromOutside` on an escape-hatch path [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-09.md).
- Lifecycle guards that revert after a state change, leaving no withdrawal path [E4](https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md).
- Governance `execute` that is not payable and forwards no value [E7](https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03.md).

## How to review
For each state-changing entry point, trace which concrete implementation actually executes, including inherited and chained `super` paths. The invariant: every reachable path that creates, moves, or settles an asset must run the same bookkeeping and authorization as its siblings, and every two-step flow must have a reachable, correctly authorized completion. Confirm the terminal base does not act unconditionally, that paired create/cancel functions populate the same structures, and that escape-hatch and payout paths can actually move existing balances.

## Variants seen
- Fallthrough to auction finalization redirects NFT to auction bidder while offer payment settles [E1](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-03.md).
- Terminal base transfer moves any unallocated escrowed NFT [E6](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-13.md).
- Inherited `offer()` skips `_rank`/`_near`, so `cancel()` cannot find it [E5](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-10.md).
- Middleware-gated `executeSlash` never implemented, so slashing never runs [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.4.md).
- Empty `executeTransactionFromOutside` traps L2 ETH under censorship [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-09.md).
- `cancelAuction` reverts post-conclusion, stranding unsold tokens [E4](https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md).
- Non-payable `execute` locks Timelock ETH [E7](https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03.md).

## Impact and severity
Asset theft [E1](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-03.md)[E6](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-13.md), unenforced slashing [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.4.md), trapped funds [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-09.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md)[E7](https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03.md). Severity rises when the path is the only escape hatch or the only settlement route, and when no alternate withdrawal exists.

## Why fixes fail
Overriding one function without its pair leaves the other path broken [E5](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-10.md); adding a guard without a post-state withdrawal path strands funds [E4](https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-03.md
- E2: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.4.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-09.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-3.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-10.md
- E6: https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-13.md
- E7: https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-03.md