Zombie DeFi contracts: abandoned code that still runs

A deprecated smart contract does not stop existing. The bytecode stays at its address, callable by anyone. The Aztec Connect RollupProcessorV3 contract learned this the hard way in June 2026, when a settlement-boundary bypass drained roughly $2.1 million from the abandoned pathway. The Rekt post‑mortem on the incident made the point clear: deprecating a product or shutting down a front end does not disable the on‑chain contract itself.

In DeFi this creates a long tail of zombie contracts. They hold residual value, accept calls, and execute logic. Attackers probe these endpoints. Bots or unwitting users may interact with legacy addresses. The risk persists because Ethereum contracts are immutable by default. Only explicit upgrade designs like proxies, UUPS, or diamonds allow behavior changes.

If an upgrade path or admin authority is removed or renounced, teams may lose the ability to pause, patch, or retire the legacy contract. That limitation follows from Ethereum's immutability model and the way upgrade patterns rely on admin roles, the Ethereum Foundation documentation notes. Deprecating a product or shutting down a website does not affect bytecode on-chain. The address remains callable, and any residual state or value persists.

Industry summaries from PANews, citing ZeroDrift, have recorded multiple drains of deprecated or legacy contracts across chains in 2025-2026. They frame this as an operational and lifecycle risk rather than a single bug class. The Aztec Connect incident is the most widely cited example. Analyses describe a settlement-boundary bypass on the deprecated pathway rather than a new cryptographic break. The critical point, the Rekt post‑mortem noted, is that the contract was still live at its address after deprecation.