Unprotected selfdestruct

What it is

A selfdestruct call removes the contract and forwards its balance to an address the caller supplies. Left unguarded, or guarded by a check an attacker can satisfy, it is a single-transaction kill switch available to the public.

Why it matters

The contract stops existing and its balance leaves with whoever called it. Every other contract that depends on this one starts failing, and there is no recovery — the deployment is gone.

How to fix it

• Remove selfdestruct unless there is a concrete reason to keep it. Most contracts do not need one.
• If it must stay, guard it with access control and a timelock, and emit an event before it runs.
• Do not rely on selfdestruct for upgrade patterns; its behaviour changed with EIP-6780 and it no longer clears code in the same way.

How it is detected

Every audit on EVM Smart Audit checks for SWC-106 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.