Access control vulnerabilities

What it is

The OWASP category covering everything from a completely unguarded privileged function to an owner who legitimately holds powers the users were never told about. It includes uninitialised proxies, roles that can grant themselves more roles, and ownership transfers with no zero-address check.

Why it matters

The highest-loss category in the OWASP list. It spans outright theft through an unguarded mint and slower harm through centralisation — an owner able to pause transfers, blacklist holders or raise fees without limit.

How to fix it

• Enumerate every privileged function and the role that guards it.
• Treat centralisation as a finding to disclose, not a bug to hide: users deserve to know what the owner can do.
• Validate addresses before storing them, especially in ownership transfers.
• Initialise proxies in the same transaction that deploys them.

A full walkthrough of this bug class, including the variants that catch teams who thought they had fixed it, is in the long-form guide.

How it is detected

Every audit on EVM Smart Audit checks for SC01 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.