Why is it dangerous to include selfdestruct() in a contract?

Smart Contracts
1

Sorry I coming again..

Why is it dangerous to include selfdestruct() in a contract?
If selfdestruct() is triggered, doesn’t it just delete the contract? Does it cause any other losses?

2

A recent incident with Tornado Cash being hacked highlights this issue. Due to the hacker using CREAT and CREAT2 in conjunction with selfdestruct(), they were able to replace contracts with different content on the same contract address. This could lead users to interact with the contract without realizing its content has been changed.
example contracts:

contract MetaDeployer{
    function deployFactory()public{
        factoryContract a = (new factoryContract){salt: "123"}(); // CREATE2
    }
}

contract factoryContract{
    proposal_20 b;
    function deployProposal_20()public{
        b = new proposal_20(); // CREATE
    }
    function deployMalicious()public{
        maliciousContract c = new maliciousContract(); // CREATE
    }
    function kill() public{
        b.emergencyStop();
        selfdestruct(payable(address(0)));
    }
}

contract proposal_20{  
    /* 
        included proposal 16 logic
    */
    function emergencyStop()public{
        selfdestruct(payable(address(0)));
    }
}

contract maliciousContract{ 
    function getFakeVote()public{
        //do something to get fake vote
    }
}
1 Like