Parity Multisig

The WalletLibrary contract — the shared logic contract that every Parity multisig wallet delegatecall'd into — was itself an uninitialized contract instance on-chain. Its initWallet function, which sets the m_owners and m_required state, had no constructor-side enforcement and no initializer guard. User devops199 invoked initWallet directly on the library address, becoming sole owner, then called the kill() function (a wrapper around SELFDESTRUCT) gated by onlyowner. Because every deployed multisig was a thin proxy that delegatecall'd into the now-destroyed library address, all 587 dependent wallets lost their executable code and ~513,774 ETH (~$150M at the time) became permanently frozen. The proximate vulnerability class is missing initializer protection on a public delegatecall target; the deeper class is a SELFDESTRUCT reachable from caller-controlled state.

Reproducible Foundry test fork from SunWeb3Sec/DeFiHackLabs. Clone the repo, run forge test against the file path above, and replay the exploit against a mainnet fork at the historical block. Use for reproduction only — not for live targets.