Deprecated contracts still holding value
Dolomite's assessment for RD-F-166 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Deprecated DolomiteMarginProtocol contract (0xe2466..., Ethereum mainnet, deployed 2019, wound down 2020) was exploited in March 2024 for $1.8M via stale user approvals. The contract itself holds no depositor TVL above $100k; the $1.8M loss came from user wallets via approvals. Team disabled the Trade Execution Coordinator promptly and issued public revoke guidance. As of 2026-05-16, Revoke.cash confirms users who have not revoked approvals remain exposed. Scoring yellow (not red): the deprecated contract's direct holdings are below $100k materiality threshold; the approval surface risk has been partially mitigated (coordinator disabled); public guidance issued. Residual risk: users who retain active approvals to 0xe2466 cannot be force-revoked. This is the materialised-once form of deprecated-surface risk.
Sources #
- URL2024 Dolomite Hack: Check If You're Affected — Revoke.cashRevoke.cash Dolomite exploit page — deprecated contract 0xe2466 and stale approval riskretrieved 2026-05-16
- Hacker Exploits Flaw in Dolomite Project, Steals $1.8M in USDCCryptoTimes incident coverage — 0xe2466 address identificationretrieved 2026-05-16
- Legacy Smart Contract Vulnerability: Post Mortem AnalysisDolomite post-mortem — deprecated contract context and team remediation actionsretrieved 2026-05-16
Methodology #
Determine whether contracts marked deprecated by a protocol announcement still hold >$100K in assets.
See the full factor methodology and distribution across all protocols →