0xdeadcode |top| -

"Dead code" isn't harmless — it’s a backdoor waiting to be activated.

function withdraw() external { if (false) { selfdestruct(payable(owner)); } // normal withdrawal logic } The optimizer removed the if (false) branch in bytecode entirely — or so I thought. Actually, the compiler preserved a JUMPDEST but no incoming JUMP opcode.

When you compile a Solidity contract, the optimizer doesn't just remove unreachable paths — it buries them. But "unreachable" at compile time is not "unreachable at runtime" if the EVM state can change.

April 13, 2026