Access Control & Governance Bugs

What you'll learn

• Who Actually Controls This Contract?
• The Core Access Control Patterns
• Parity Multisig: The 513K ETH Freeze
• Ronin Bridge: $625M from a 5-of-9 Compromise
• Bybit: 400K ETH from a Signed Transaction
• Upgradeable Proxies: Transparent vs UUPS vs Diamond

Key terms

Ownable

OpenZeppelin's single-owner access pattern. Simple but fragile — if the owner key is compromised, the contract is lost. Ownable2Step adds a safer two-step transfer flow.

AccessControl (role-based)

OpenZeppelin's pattern for multiple roles with different privileges. Each role is separately grantable/revokable; DEFAULT_ADMIN_ROLE controls grants. The right pattern for non-trivial privileged-action sets.

Timelock

A contract that delays the execution of privileged actions (commonly 24-72 hours), giving users time to react before changes take effect. Compound's Governor + Timelock is the canonical reference.

Multisig (Safe / Gnosis Safe)

M-of-N signature scheme used by virtually every serious protocol for treasury and admin keys. Security depends on signers being independent, geographically distributed, using hardware wallets, and verifying transactions at the hardware-wallet level — not just in the desktop UI.

Parity multisig freeze

November 6, 2017 — user devops199 triggered a selfdestruct on a shared library contract that hundreds of Parity multisig wallets depended on. ~513,774 ETH permanently frozen. The reason OpenZeppelin's Initializable now disables initializers on implementation contracts by default.

Ronin Bridge hack

March 23, 2022 — Lazarus Group socially engineered a Sky Mavis engineer, compromised 4 of 9 validator keys, and used a stale Axie DAO delegation as the fifth signature to drain ~$625M from the Axie Infinity bridge. Largest theft up to that point.

Bybit cold wallet theft

February 21, 2025 — Lazarus Group manipulated the Safe signing UI to swap a routine transfer for a malicious upgrade, draining ~400,000 ETH (~$1.5B) from Bybit's Ethereum cold wallet. Largest crypto theft on record; covered by Bybit from corporate reserves.

EIP-2535 Diamond

A modular upgradeable-proxy pattern where a single proxy delegates to multiple facet contracts via a selector-to-facet registry. Enables granular upgrades and bypasses the 24KB code size limit, at the cost of complexity.

UUPS (EIP-1822)

Upgradeable proxy pattern where the upgrade function lives in the implementation, not the proxy. Lower per-call gas than Transparent, but requires every implementation to include and properly gate _authorizeUpgrade — missing this check has caused multiple production incidents.

Transparent proxy

OpenZeppelin's original upgradeable-proxy pattern. Separates admin and user code paths via the proxy itself; a ProxyAdmin contract holds upgrade rights. Slightly higher gas per call than UUPS but conceptually simpler.