Skip to content
high Access Control SWC-115 CWE-284

Rescue/Sweep Function Can Take User Funds

SAFE-0225 Access Control Checked automatically by the scanner
1

What goes wrong

An owner rescue/sweep function can withdraw the protocol's core token or user deposits, not just accidentally-sent stray tokens. This is a rug-pull primitive: the admin can drain everything under the guise of 'recovering' tokens.

2

The vulnerable pattern

proof of concept — how it is exploited
// function sweep(address t) external onlyOwner { IERC20(t).transfer(owner, bal); }
// owner: sweep(stakingToken) -> every staker's deposit sent to owner.
3

How to fix it

the pattern that is safe
function rescue(IERC20 t) external onlyOwner {
  require(t != stakingToken && t != rewardToken, "protected");
  t.safeTransfer(owner(), t.balanceOf(address(this)));
}
◆
Exclude protocol/user tokens from any rescue function.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$1.43B · 2025 Bybit Access control · 2025 $624M · 2022 Ronin Network Access control · 2022 $611M · 2021 Poly Network Access control · 2021 $291M · 2026 KelpDAO rsETH Access control · 2026
5

Related vulnerabilities in Access Control

SAFE-0006Missing Access Control on Privileged Function critical · Access Control SAFE-0008Unprotected Initializer / Initialization critical · Access Control SAFE-0010Privilege Escalation via Role Misconfiguration critical · Access Control SAFE-0015Backdoor / Hidden Privileged Function critical · Access Control SAFE-0116Unprotected selfdestruct critical · Access Control SAFE-0007tx.origin Used for Authentication high · Access Control SAFE-0009Missing Initializer Disable on Implementation high · Access Control SAFE-0013Authorization Through msg.data / Signature Confusion high · Access Control
← PreviousrenounceOwnership Can Brick Privileged Functions
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0225 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs