Abandoned DeFi Protocols Leave Zombie Smart Contracts Behind

A zombie smart contract is on-chain code that a team has deprecated or stopped maintaining but that still runs and can hold funds, accept calls, or execute logic. Public deprecation notices or shutting down a front end do not disable the contract itself. The bytecode remains live at its address, so interactions continue as long as callers provide valid inputs. This dynamic is documented in the Rekt post‑mortem on Aztec Connect. In DeFi, this leaves a long tail of abandoned contracts that keep economic value and callable entry points on-chain. Attackers probe these endpoints, and bots or unaware users may interact with legacy addresses. The risk persists because Ethereum contracts are immutable by default; only explicit upgrade designs allow behavior changes. If an upgrade path or admin authority is removed or renounced, teams may be unable to pause, patch, or retire the legacy contract. That limitation follows from Ethereum’s immutability model and the way proxy/UUPS/diamond patterns rely on admin roles, as described in the Ethereum Foundation smart contract security docs. How zombie smart contracts persist on-chain Ethereum smart contracts cannot be changed once deployed. Any ability to alter behavior must be explicitly designed through patterns such as proxies, UUPS, or diamonds, which delegate calls to upgradeable logic. These patterns depend on admin keys or governance roles. If those roles are misconfigured, compromised, or renounced, the team can lose the ability to fix or retire the contract entirely, even if they have deprecated it publicly. See the Ethereum Foundation documentation for the security implications of immutability and upgrade patterns. Deprecating a product or shutting down a website does not affect bytecode on-chain. The address remains callable, and any residual state or value persists. Attackers can interact directly via transactions, and integrators that still point to a legacy address can unknowingly route users to deprecated logic. The phenomenon of abandoned or zombie contracts has been observed for years in academic and empirical work, including early measurements of dormant and unmaintained contracts on Ethereum noted by CSIRO Data61 (2016 analysis). What turns deprecation into an attack surface Post‑deprecation risk is not theoretical. It emerges from several practical mechanics identified in incident reconstructions: Live entry points: functions remain callable even after a project announces deprecation, leaving useful operations open to adversaries. This was highlighted in the technical reconstruction of Aztec Connect. Residual value: immutable contracts may still hold funds or liquidity‑provider positions, turning them into honeypots for specialized exploits or state manipulations. Broken assumptions about admins/off‑chain actors: if a contract expects an operator, relayer, or sequencer to behave in a certain way, those assumptions can fail once teams wind down or keys are removed.