In the last few weeks two protocols were drained through the same class of bug: an access-control exploit. RISEx lost ~$673k. WEMIX.FI Lend lost ~$730k. Different codebases, same shape of mistake - a state-changing function that should have been restricted to an owner or role, but wasn't.
This is, year after year, one of the most common ways money leaves a smart contract. And it's one of the few high-impact bug classes a static tool can actually catch before deploy - because it's a property of the code, not of an off-chain secret.
The bug, in one screen
The pattern looks like this - a critical function with no guard:
// A function that moves value or changes who's in control...
