Access Control Vulnerabilities in Smart Contracts: The Data

By the Guardian team Updated November 2026 6 min read

Quick answer. One missing check gives any caller admin power, and Access Control led DefiLlama's hack counts in 2024 and 2025. By dollars it ranks lower, and most of its losses since 2024 involved keys, signers or an insider.

Watch: Access Control Vulnerabilities in Smart Contracts: The Data 1:40

Video transcript

One missing check can give any caller admin power. Access control led DefiLlama's hack counts in 2024 and 2025, but not the dollar losses.

OWASP ranks access control first for 2026. Yet its own 2025 data puts it second by losses, at 220 million dollars, behind integer overflow.

In DefiLlama's data, about one hack in five or six carries the access control label. Most are small, with a median loss under one million dollars each year.

Four of the five largest access control losses since 2024 involved keys, signers or an insider, like Drift at about 295 million dollars.

Guardian's own audits show the code side: 53 Critical and High findings in five patterns. Missing checks, trusted caller-supplied identities, broken role and signer logic, unverified callbacks, and unprotected initializers.

Testing starts with a permission matrix. Call restricted functions from an unprivileged account, call callbacks directly, run initializers twice, pass another user's IDs, and fuzz with random callers.

Code decides who may call a function, and key security decides who holds the role. Guardian's Managed Security maps every path to your funds, monitors contracts on every block, and reviews every multisig transaction before signing. Audits test the code and the keys.

Read the full article for the data, the checklist and the method. Or talk to Guardian to map who can move your funds.

Access control is the first entry in the OWASP Smart Contract Top 10 for 2026. It starts from one question about every function: who can call this?

But "the top cause of losses" depends on what you count. A stolen admin key and a missing modifier often get the same label.

We pair public loss data with 53 Critical and High access control findings from Guardian's published audits, then turn them into tests.

The Loss Data

OWASP's 2026 ranking combines a practitioner survey with 2025 incident data. It defines the risk as a contract not rigorously enforcing "who may invoke privileged behavior".

By dollars, its own 2025 data puts access control second: $220.0M of $905.4M in smart contract losses. Integer overflow ranks first at $260.4M, led by Cetus.

The 2025 edition was starker. Using SolidityScan's Web3HackHub, it put $953.2M of 2024's $1.42B under access control.

DefiLlama's public hacks dataset shows the same split between frequency and dollars.

Year	Access Control incidents	Share of incidents	Losses	Share of losses
2024	43 (most common)	19.8%	$134.3M	8.0%
2025	31 (most common)	20.9%	$131.5M	4.8%
2026 to Nov 2	54 (second)	16.5%	$370.8M	4.2%

About one hack in five or six carries the label. Most are small: 120 of the 128 since 2024 lost less than $10M, and the median loss was under $1M each year.

How We Counted

Loss data. DefiLlama's hacks API, pulled November 4, 2026 (latest entry November 2), summed by calendar year.
Audit data. Guardian's public portfolio as of November 5, 2026: 320 reports, 343 Criticals and 845 Highs.
Which findings count. Criticals and Highs labeled Access Control, or whose title names an access failure.
Reading check. We read each title match and kept it only if the flaw was about who may act.
Patterns. We assigned each finding to one pattern by hand, after reading its description.

That gives 53 findings, 23 Critical and 30 High, in 36 reports for 27 clients.

The count is a floor. A Synthetix Critical where a function "no longer has access control" is labeled DoS, so it is not included.

Label counts use the same rules as our Critical findings report. It counted 360 Criticals in 337 reports, before 17 reports left the portfolio.

Five Access Control Bug Patterns

Access Control is tied for the fourth most common label on Guardian Criticals: 14 of 343 (4.1%). Counting titles too, it reaches 23 Criticals (6.7%).

Pattern	Critical	High	Example
Missing check on a sensitive function	8	8	Orderly LCMU-1
Trusting a caller-supplied identity	5	6	PariFi ORDM-1
Role, signer and permission logic	0	10	Ethena H-01
Unverified callback or hook caller	5	3	Gamma C-06
Unprotected or repeatable initializer	4	3	Degen Safe C-04
Labeled access control, other cause	1	0	None

The last row holds one labeled finding with another cause: a bridge message that could be replayed on a second chain.

1. Missing check on a sensitive function

The largest group. Orderly's setTokenDecimal had no access control, so any user could set a token's decimals and drain the vault.

At GMX (C-02), a new bridge deposit function was missing its onlyController modifier.

2. Trusting a caller-supplied identity

The function checks a parameter instead of the caller. PariFi's modifyPosition accepted any position ID without checking that the caller owned it.

3. Role, signer and permission logic

The roles exist, but the rules around them are wrong. In Ethena Pay, a signer pending removal could sign the cancellation of its own removal.

4. Unverified callback or hook caller

Gamma's limit order hook left beforeSwap and afterSwap open to any caller. Buttonwood (C-02) had a deploy callback that let an attacker mint tokens.

This one has a live loss behind it. DefiLlama records $12M taken from Cork in May 2025 through an unprotected beforeSwap hook.

5. Unprotected or repeatable initializer

Degen Safe's Solana vault let any user call initialize again and seize the vault's authority.

A related live case: DefiLlama records Ronin Bridge exploited for $12M in August 2024 after an upgrade skipped an initialization step.

Fixes and status

Fixes need a second look. Clanker limited a fee function to its pool hook; the fix review found a similar attack through the hook.

Teams resolved 88.7% of these findings, against 75.1% for all Criticals and Highs. Only one Critical was acknowledged.

Key Compromise Versus Code Bugs

In DefiLlama's descriptions, four of its five largest Access Control losses since 2024 involved keys, signers or an insider:

Drift, April 2026, about $295M: Security Council members tricked into pre-signing transactions.
UPCX, April 2025, $70M: a compromised private key used to upgrade a ProxyAdmin contract.
Munchables, March 2024, $62.5M: a rogue developer who built in vulnerabilities.
SUPERFORTUNE AI, May 2026, $15.2M: a lookalike address slipped into a multisig transaction.

Those four hold 69.5% of the $636.6M filed under Access Control since 2024.

Set them aside, and code-level access control is 4.3% of 2024 losses, 2.3% of 2025 and 0.7% of 2026.

Keys and people cost far more. Key Compromise and Social Engineering were 69.0% of DefiLlama's 2024 losses and 68.1% of 2025.

So both questions matter. Code decides who may call a function; key security decides who holds the role. See how the Drift exploit worked and where hack losses came from.

How to Test Permissions

Start with a permission matrix: every external function, who may call it, and what state it changes. Then test against it.

Negative tests. Call every restricted function from an unprivileged account and expect a revert.
Direct callback calls. Call each hook and callback from an attacker contract, outside the intended flow.
Re-initialization. Call every initializer twice, on the proxy and the implementation, after each upgrade.
Someone else's IDs. Pass another user's address, position or account wherever a function takes one.
Role lifecycles. Test grant, revoke, rotation, pending removal and timelocked changes, not just the happy path.
Random callers. Fuzz with many actors against invariants such as "only the admin role changes fees".

OWASP gives the same advice: encode access control policies in tests, fuzzing properties and, where possible, formal specifications.

Access Control Checklist

Every state-changing external function has an explicit check, or a written reason it is open.
Hooks and callbacks verify the caller is the expected pool, router or manager.
Initializers run once, with initializer or reinitializer guards.
No function trusts a user, owner or position ID it did not check against the caller.
Roles use tested libraries, such as OpenZeppelin's Ownable or AccessControl.
Privileged roles are few, documented and held by multisigs or governance, not single keys.
Every role, ownership and upgrade change emits an event someone watches.
Every update gets a permissions diff before it ships.

Items 2, 3, 5, 6 and 7 follow OWASP's SC01:2026 guidance. To see who holds admin roles at large protocols, read our admin key census.

How Guardian Covers Access Control

Guardian's Managed Security maps every path to a protocol's funds: the contracts that hold them, the roles that can move them, and the keys, signers and multisigs behind each one.

It monitors contracts on every block, including privileged calls, role and ownership changes, upgrades and multisig transactions.

Guardian's security operations team reviews every multisig transaction before it is signed.

An OpSec audit maps and tests keys, signers and privileged roles. A smart contract audit tests the checks in code.

Frequently Asked Questions

Why are access control vulnerabilities so common in smart contracts?

Any function a contract exposes can be called by anyone unless the code checks the caller. One forgotten check, callback or initializer is enough. Of the 53 Guardian findings we counted, 27 are missing checks or trusted caller-supplied identities.

Is access control the top cause of smart contract losses?

Not always. OWASP ranks it first for 2026, but its 2025 data puts it second by losses ($220.0M). In DefiLlama, most Access Control dollars since 2024 came through keys, signers and an insider.

What is the difference between an access control bug and a key compromise?

An access control bug lets the wrong caller use a privileged function. A key compromise lets an attacker act as the right caller. Loss databases often file both under access control, so read the root cause.

How do you test smart contract access control?

List every external function and who may call it. Then call each one from an unprivileged account, call callbacks and initializers directly, pass other users' IDs, and fuzz with random callers against permission invariants.

Sources

Map who can move your funds

Guardian maps every role, key and signer behind your contracts and watches each privileged change as it lands.

Talk to Guardian Explore Managed Security