SlowMist Reveals Aztec Connect Exploit Highlights Deprecated Contract Risks

Blockchain security firm SlowMist has published an analysis of an exploit involving Aztec Connect, a deprecated smart contract bridge for the Aztec privacy protocol. The incident highlights the persistent security risks posed by immutable smart contracts that remain active even after being deprecated.

According to SlowMist, the exploit targeted a vulnerability in the Aztec Connect contract, which had been marked as deprecated but remained unaltered on-chain due to its immutable nature. Attackers were able to drain funds by exploiting the contract's unchanged code, taking advantage of its continued functionality.

Long Tail Risk of Deprecated Contracts

SlowMist's report emphasizes that deprecated smart contracts often retain full operational capacity unless explicitly disabled or destroyed. Because immutability prevents modifications, such contracts can become attractive targets over time as new attack vectors emerge. The firm recommends that projects implement mechanisms to pause or render deprecated contracts inoperable.

• Aztec Connect was a bridge between Aztec and Ethereum, facilitating private transactions.
• The exploit occurred after the contract was deprecated but still accessible.
• SlowMist advises periodic security audits and graceful shutdown procedures for outdated contracts.

Aztec has not disclosed the exact amount lost in the exploit. The incident serves as a cautionary example for DeFi projects managing legacy code on immutable blockchains.