Stateless by design: a contract that holds nothing is a contract that cannot lose it
Known formally as Statelessness as a Security Property in the BlazePhoenix whitepaper.
BlazePhoenix Engineering · updated 2026-07-29 · 9 min · written from the deployed bytecode
By Mitra (@Sigmacrit) — anonymous developer of the BlazePhoenix protocol. The code is the résumé.
Abstract in 15 languages · resumo · resumen · 摘要 · 要旨 · ملخص
English — The smallest attack surface is the state you never keep. A contract that ends every transaction holding nothing — no idle balance, no persistent cross-call flag — removes whole exploit classes by construction, using transient storage that cannot be poisoned across transactions.
Português — A menor superfície de ataque é o estado que nunca guardas. Um contrato que acaba cada transação sem nada — sem saldo parado, sem flag persistente entre chamadas — remove classes inteiras de exploits por construção, com armazenamento transitório que não pode ser envenenado entre transações.
Español — La menor superficie de ataque es el estado que nunca guardas. Un contrato que termina cada transacción sin nada — sin saldo ocioso, sin flag persistente entre llamadas — elimina clases enteras de exploits por construcción, con almacenamiento transitorio no envenenable entre transacciones.
Français — La plus petite surface d'attaque est l'état que l'on ne garde jamais. Un contrat qui finit chaque transaction sans rien — pas de solde inactif, pas de drapeau persistant entre appels — supprime des classes entières d'exploits par construction, via un stockage transitoire non empoisonnable entre transactions.
Deutsch — Die kleinste Angriffsfläche ist der Zustand, den man nie hält. Ein Vertrag, der jede Transaktion mit nichts beendet — kein Restguthaben, kein persistentes Cross-Call-Flag — entfernt ganze Exploit-Klassen konstruktiv, mit transientem Speicher, der über Transaktionen hinweg nicht vergiftet werden kann.
Русский — Наименьшая поверхность атаки — состояние, которое вы не храните. Контракт, завершающий каждую транзакцию ни с чем — без праздного баланса, без стойкого флага между вызовами — конструктивно устраняет целые классы эксплойтов, используя временное хранилище, неотравляемое между транзакциями.
Türkçe — En küçük saldırı yüzeyi hiç tutmadığın durumdur. Her işlemi elinde hiçbir şey olmadan bitiren bir sözleşme — atıl bakiye yok, çağrılar arası kalıcı bayrak yok — işlemler arası zehirlenemeyen geçici depolama ile bütün istismar sınıflarını yapısal olarak kaldırır.
العربية — أصغر سطح هجوم هو الحالة التي لا تحتفظ بها أبدًا. عقد ينهي كل معاملة دون شيء — لا رصيد خامل ولا علم دائم بين الاستدعاءات — يزيل فئات كاملة من الثغرات بالبناء، بتخزين مؤقت لا يمكن تسميمه عبر المعاملات.
हिन्दी — सबसे छोटी अटैक सतह वह स्थिति है जिसे आप कभी नहीं रखते। हर लेनदेन को बिना कुछ रखे समाप्त करने वाला अनुबंध — कोई निष्क्रिय शेष नहीं, कॉलों के बीच कोई स्थायी फ्लैग नहीं — रचना से ही पूरे एक्सप्लॉइट-वर्ग हटा देता है, ऐसे ट्रांज़िएंट स्टोरेज से जो लेनदेन के पार विषाक्त नहीं हो सकता।
日本語 — 最小の攻撃面は、そもそも保持しない状態です。各トランザクションを何も持たずに終える契約は — 遊休残高もなく、呼び出しをまたぐ永続フラグもなく — トランザクション間で汚染されない一時ストレージにより、まるごとの脆弱性クラスを構造的に消します。
中文 — 最小的攻击面是你从不保存的状态。让每笔交易结束时一无所有的合约——没有闲置余额、没有跨调用的持久标志——凭借跨交易无法被污染的瞬态存储，从构造上消除整类漏洞。
한국어 — 가장 작은 공격 표면은 아예 보관하지 않는 상태입니다. 모든 트랜잭션을 아무것도 들지 않은 채 끝내는 계약은 — 유휴 잔액도, 호출 간 지속 플래그도 없이 — 트랜잭션을 넘어 오염될 수 없는 트랜지언트 스토리지로 전체 익스플로잇 계열을 구조적으로 제거합니다.
Bahasa Indonesia — Permukaan serang terkecil adalah keadaan yang tak pernah kamu simpan. Kontrak yang mengakhiri tiap transaksi tanpa apa pun — tanpa saldo menganggur, tanpa flag lintas-panggilan yang persisten — menghapus seluruh kelas eksploitasi secara konstruksi, memakai penyimpanan transien yang tak bisa diracuni antar transaksi.
বাংলা — সবচেয়ে ছোট আক্রমণ-পৃষ্ঠ হলো যে অবস্থা আপনি কখনো রাখেন না। প্রতিটি লেনদেন কিছু না রেখে শেষ করা চুক্তি — কোনো অলস ব্যালেন্স নেই, কলের মধ্যে স্থায়ী ফ্ল্যাগ নেই — গঠনগতভাবে গোটা এক্সপ্লয়েট-শ্রেণি সরায়, এমন ট্রানজিয়েন্ট স্টোরেজ দিয়ে যা লেনদেনের ওপারে বিষাক্ত হতে পারে না।
Filipino — Ang pinakamaliit na attack surface ay ang estadong hindi mo iniingatan. Isang kontratang nagtatapos sa bawat transaksyon nang walang hawak — walang idle na balanse, walang persistent na flag sa pagitan ng tawag — ay nag-aalis ng buong klase ng exploit sa disenyo, gamit ang transient storage na di-mala-lason sa pagitan ng mga transaksyon.
The cheapest thing to secure is the thing you never hold. Persistent state is standing attack surface: every slot a contract keeps between transactions is a slot an attacker has unlimited time to poison, and every token it holds at rest is a token a later crafted transaction can try to sweep. A large class of exploits is not about breaking the logic of a single call at all — it is about corrupting something the contract left lying around between calls. Statelessness is the discipline of leaving nothing there.
Two meanings of stateless, one instinct
The word carries two layers. At the base layer, statelessness is a protocol research direction: stateless clients and state expiry aim to let a validator verify a block without holding the entire world state, carrying proofs instead of the full tree. At the contract layer — the subject here — statelessness means a contract that keeps no persistent state of its own between calls: it opens, executes, settles, and returns to rest carrying nothing. The layers are different, but the instinct is the same one running in both directions: state you must hold is a cost and a liability, so hold as little of it as the job allows.
Hold nothing
The strongest form of the discipline is an invariant: the contract is left holding nothing at rest. A swap pulls an input, routes it through pools, pays the output, and ends with a zero balance. Real execution leaves residuals — a partial fill at a price limit, rounding across split legs, a non-conforming pool that declined what it was handed — and the naive contract either strands them (where a later crafted route can sweep them) or reverts a legitimate swap. The stateless discipline does neither: it sweeps every residual back to the caller in the same transaction, so nothing accumulates. There is no idle balance, so there is nothing for a future transaction to steal, and the whole class of stuck-or-sweepable-funds bugs is removed by construction rather than patched.
The primitive: transient storage
The concrete tool that makes contract-level statelessness practical is transient storage — a per-transaction scratch space that is written and read like storage but is automatically wiped when the transaction ends. A reentrancy lock, the pool and token context handed to a swap callback, the input and output currencies for a settlement sequence: all of it lives in slots that do not survive the transaction that created them.
The security consequence is precise. State that cannot persist across transactions cannot be poisoned across transactions. A reentrancy guard in transient storage is set at entry and cleared at exit, and even if that clearing were skipped, the value evaporates with the transaction rather than lingering as a corruptible flag. Cross-call context that would be a standing liability as a storage slot becomes a value that exists only while the work is in flight.
Why ephemerality shrinks the surface
A system that carries no history has a defect window of a single block and a blast radius that is local to one transaction. There is no accumulator to drift, no stored multiplier to go stale, no clock whose advance can be left unwritten — the entire time-dimension family of defects is simply absent, because there is no time dimension. The number a stateless quoter returns is computed by the same code path that would execute the trade, in the same call, so the quote is the execution rather than a stored figure that can diverge from it.
This is the sharp contrast with systems that must accrue over time. A staking or lending book cannot be stateless — its entire purpose is to remember who was present while value accrued — and that memory is exactly where its hardest defects live. The lesson is not that every contract can be ephemeral; it is that the state a contract chooses to hold should be the minimum its job truly requires, because every unit of held state is a unit of attack surface and a unit of the harder, time-shaped risk that conservation cannot see.
Statelessness is not austerity
Refusing to hold state is often read as giving something up. It is the opposite: it is refusing to hold what can be lost. A contract with no idle balance cannot be drained of an idle balance. A contract with no persistent cross-call flag cannot have that flag corrupted. A system that recomputes rather than remembers cannot serve a stale memory. The austere-looking contract is the one whose set of things-that-can-go-wrong is small enough to enumerate — and enumeration, as the companion pieces argue, is the whole game.
Do not trust this page — reproduce it
Every claim above is checkable against the chain. Start here:
Read the contract's own balance of any token at rest, between transactions — a hold-nothing design returns zero, so there is no idle balance for a later crafted transaction to sweep; then look for persistent flags a reentrancy or callback path leaves in storage, because transient-storage equivalents cannot be poisoned across transactionsContracts are verified on every chain we deploy to — addresses in the protocol manifest. Deeper formal treatment: the whitepaper (PDF). Standards cited: EIP-1153
Share this article · join the discussion