Abandoned DeFi Protocols Leave Zombie Smart Contracts Behind

A zombie smart contract is on-chain code that a team has deprecated or stopped maintaining but that still runs and can hold funds, accept calls, or execute logic. Public deprecation notices or shutting down a front end do not disable the contract itself. The bytecode remains live at its address, so interactions continue as long as callers provide valid inputs. This dynamic is documented in the Rekt post‑mortem on Aztec Connect.

In DeFi, this leaves a long tail of abandoned contracts that keep economic value and callable entry points on-chain. Attackers probe these endpoints, and bots or unaware users may interact with legacy addresses. The risk persists because Ethereum contracts are immutable by default; only explicit upgrade designs allow behavior changes.

If an upgrade path or admin authority is removed or renounced, teams may be unable to pause, patch, or retire the legacy contract. That limitation follows from Ethereum’s immutability model and the way proxy/UUPS/diamond patterns rely on admin roles, as described in the Ethereum Foundation smart contract security docs.

… Continue reading the full article at the original source below.