Zombie Smart Contracts Pose Growing Risk to Financial Industry

The financial industry has been grappling with a growing problem - zombie smart contracts. These are on-chain codes that have been deprecated or stopped maintaining by their teams, but still run and hold funds, accept calls, or execute logic.

Public deprecation notices or shutting down front ends do not disable the contract itself. The bytecode remains live at its address, so interactions continue as long as callers provide valid inputs.

This dynamic is documented in the Rekt post-mortem on Aztec Connect, which highlights the risks associated with zombie smart contracts. Attackers probe these endpoints, and bots or unaware users may interact with legacy addresses.

The risk persists because Ethereum contracts are immutable by default; only explicit upgrade designs allow behavior changes. If an upgrade path or admin authority is removed or renounced, teams may be unable to pause, patch, or retire the legacy contract.