Assessment reports>SP1 Helios>Discussion>Loss of the guardian role after calling the relinquishGuardian function

Loss of the guardian role after calling the relinquishGuardian function

In the SP1Helios contract, the guardian role is responsible for managing the lightClientVkey and storageSlotVkey, which are used for light-client state updates and verifying values of specific storage slots, respectively. The functions updateLightClientVkey and updateStorageSlotVkey, which allow modification of these Vkeys, can only be called by an account with the guardian role.

function relinquishGuardian() external onlyGuardian {
    guardian = address(0);

    emit GuardianRelinquished();
}

The relinquishGuardian function resets the state variable that stores the guardian address to the zero address. After this function is called, no one can invoke updateLightClientVkey or updateStorageSlotVkey anymore. While this allows the contract's Vkeys to be frozen, the irreversible nature of this functionality should be clearly documented.

Zellic © 2025Back to top ↑