The Confused Deputy in the Machine: Three SonicWall SSRF Cycles and the Pre-Authentication Debt in Crypto Infrastructure

The data shows a pattern that should not exist in a mature product line. Three disclosure cycles. Three times, the same opening move. In the SonicWall SMA1000 remote-access gateway series, the entry point has been a pre-authentication server-side request forgery — CWE-918 colliding with CWE-441 — logged across the 2026 advisory sequence as CVE-2026-15409, CVE-2026-83548, and finally CVE-2026-102255 at a CVSS of 10.0. Each cycle patched the symptom. None of them closed the design record. I have seen this shape before. Not in a VPN appliance. In the relay layer of a cross-chain bridge. In the RPC gateway of a large infrastructure provider. In the upgradeable proxy of a DeFi protocol that shipped three "fixes" without ever moving its trust boundary. The bug is never the bug. The bug is where authentication sits relative to trust. Silicon whispers beneath the cryptographic surface, and what it says here is a warning the crypto industry has not finished reading. This is not a story about a security vendor's bad quarter. It is a structural case study in what I call pre-authentication debt — the accumulated architectural liability of systems that let an edge process act on behalf of a requester before that requester has proven anything. The SMA1000 is simply the clearest specimen I have examined this year. Let me establish the mechanics before drawing the parallel, because the parallel only holds if the mechanics are exact. The SonicWall SMA1000 is an enterprise network-boundary appliance — an SSL-VPN and remote-access gateway. It ships in hardware SKUs (6210, 7210) and a virtualized form (8200v). It is not a growth product. It is a mature line in maintenance mode, and that detail matters more than any CVE number. The appliance exposes three distinct management surfaces: the Work Place portal, the /wsproxy endpoint, and the Appliance Management Console, or AMC. Each is an edge-facing interface. Each, per the advisory sequence, has carried its own independent vulnerability. Three exposed surfaces, three separate bugs, no unified gateway governance. That is the first structural signal — attack-surface convergence failed. The architectural flaw is what the advisory describes as a "confused deputy" condition, mapped to CWE-441. In plain terms: the edge reverse proxy — Work Place, /wsproxy — can be induced to perform actions on behalf of the requester while the requester is still unauthenticated. The proxy holds authority. The proxy acts. The requester has proven nothing. Authentication is evaluated after the trust decision, not before it. This is a design-level defect, not a coding-level one. You cannot patch a trust boundary mismatch the way you patch a missing bounds check. You can only re-draw the boundary. And re-drawing the boundary on a mature hardware product line is expensive, slow, and organizationally painful — which is precisely why it does not happen, and why the same SSRF shape reappeared three times. The full exploit chain in the disclosure is instructive because it is layered: a pre-authentication SSRF (CWE-918/441, CVSS 10.0) at the edge, followed by an authenticated command injection (CWE-78), a Zip Slip path traversal (CWE-22), and a stored XSS (CWE-79). Pre-auth entry, post-auth execution. The pre-authentication SSRF is the door; the command injection is the payload; Zip Slip and XSS are the persistence and lateral-movement layers. And here is the detail that should alarm any infrastructure engineer: pre-auth and post-auth vulnerabilities were disclosed in the same batch. That is not a single missed check. That is defense-in-depth failing at multiple layers simultaneously. The code remembers what the auditors missed — and in this case, the auditors missed an entire philosophy, not a line. The human-impact layer compounds it. The advisory references MFA seed theft — the compromise of authentication credentials themselves — followed by ransomware deployment attributed to actors tracked as UTA0533 and INC. And critically: "no mitigation measures." When a vendor says there is no workaround, it means every ounce of security pressure lands on the customer's firmware-upgrade execution. The vendor's architecture debt has been transferred to the operator's to-do list. That is a hidden form of liability transfer, and it is worth naming. Now the parallel. Because if you read the SMA1000 case only as a VPN story, you have missed the point. The confused deputy is the dominant failure mode of the entire crypto infrastructure stack in 2026, and almost nobody is auditing for it. Start with the bridge relayer. A cross-chain bridge is, structurally, a confused deputy. A relayer observes an event on chain A and submits a message to chain B. The relayer acts with authority — it can mint, unlock, or release value — and the question that determines whether the bridge survives is a single one: does the relayer verify the message before acting, or act and then verify? Every major bridge exploit of the last five years is a variation on this question. Nomad is the cleanest example. A single initialization transaction set a "trusted root" to a value anyone could spoof, and once that root was wrong, the entire contract acted on behalf of any requester with no authentication. It was not a cryptographic break. It was a pre-authentication trust decision made in the wrong order. Thousands of copycat attackers drained the bridge by simply replaying the same "valid" message. The deputy was confused. The deputy had authority. The deputy had no gate. Tracing the gas leaks in the 2017 ICO ghost chain was where I first learned to read a system's trust boundary from its failures rather than its whitepaper. That same method applies here. You do not find the confused deputy in the marketing page. You find it in the call graph, at the exact hop where authority is exercised and nothing has been proven. Now look at the RPC gateway. Every major provider — the ones every wallet and every dApp depends on — sits in exactly the position of the Work Place proxy. A user's wallet sends eth_call, eth_estimateGas, eth_sendRawTransaction. The gateway parses, routes, and often augments that request before forwarding to a node. The gateway acts on behalf of the requester. And in most architectures, the requester is unauthenticated for the read path — which is fine until the gateway's routing logic can be induced to reach an internal endpoint, or until a compromised gateway can silently rewrite the destination of a transaction. The SMA1000's /wsproxy and the RPC gateway's routing layer are the same shape: an edge process with too much authority, making trust decisions before authentication. Then the upgradeable proxy — the DeFi-native instance. A proxy contract holds the storage and funds; it delegatecalls into an implementation. The proxy is the deputy. It acts with the full authority of the protocol. The question is whether the call to the implementation is guarded before it executes. I have reverse-engineered enough of these to know that the failure mode is nearly always the same as the appliance: an administrative entry point — an initialize function, a reinitialization path, a fallback that delegatecalls an attacker-supplied address — that is reachable before the access control is evaluated. Pre-auth in contract terms means pre-guard. The 2017 EOS audit I ran as a twenty-five-year-old taught me the lesson I have never unlearned: the race condition that mattered was not in the consensus math; it was in the ordering of the trust check relative to the deferred action. Same disease. Different host. And the oracle network. A price feed is a confused deputy in the most literal sense. It reports a number with authority. Protocols act on that number — liquidations, minting, collateral checks — with no independent verification, because the oracle is presumed trustworthy by design. When the deputy can be induced to report a false value before the consumer has authenticated the source's freshness and deviation bounds, you get the classic oracle-manipulation drain. The fix is never "better data." The fix is a consumer-side guard that evaluates trust before action. Pre-auth, again. The 2022 Anchor Protocol forensics I ran after the Terra collapse is the same lesson in a different costume. Anchor was a confused deputy. It paid yields with authority — depositors acted on those yields as if they were real returns — while the source of the yield was Luna minting, an unauthenticated money printer. The protocol acted on behalf of its users before the sustainability of its own revenue was ever verified. Six months before the crash, the causal chain was legible: the deputy was paying out value it had not authenticated. The number of people who wanted to hear it was small. The number of people who needed to hear it was everyone. The 2026 AI-crypto convergence sharpens it further. When I audited the verification layer of a decentralized AI compute marketplace this year, the confused deputy was the recursive SNARK verifier itself. The verifier acts on behalf of a prover — it attests that a model inference was computed correctly — and the flaw I found was an optimization in the recursion that inflated verification cost by forty percent. The cost inflation was a symptom; the structural question underneath it was whether the verifier authenticated the prover's claim before or after accepting the proof into the settlement path. Scalability in AI-agent economies depends on cryptographic primitives, and every primitive is a deputy. Get the ordering wrong and you have built a market that settles on unauthenticated claims at scale. The 2024 ETF custody analysis is the institutional mirror. When I examined BlackRock's IBIT custodial infrastructure after approval, the deputy was the custodian — acting with authority over reserves before the proof-of-reserve attestation had authenticated them, with measurable latency in the attestation path. The gap between regulatory compliance and on-chain transparency is, structurally, a pre-authentication window. For a period each day, the custodian acts and the proof has not yet spoken. That window is small for a compliant custodian and fatal for a leveraged protocol that treats the attestation as real-time. Sequencer design in the Layer2 stack is the newest instance and the least understood. A sequencer orders transactions with authority before the base layer has authenticated them. That is its entire job — it acts first, and the rollup's fraud or validity proof catches up later. Pre-confirmation is a pre-authentication action by design. When a sequencer censors, reorders, or withholds, it is exercising authority the base layer has not yet validated, and users who act on pre-confirmed state are trusting a deputy that has not been checked. Forced-inclusion mechanisms exist precisely to bound this window. Most rollups deploy them late, if at all, and every day before they exist is a day the deputy runs unauthenticated. The MEV supply chain is a confused deputy with a profit motive. A block builder assembles a block with authority — it decides ordering, inclusion, and extraction — before the proposer has authenticated the block and before the network has validated it. Searchers act on the builder's ordering assumptions; the builder acts on the searcher's bundles. It is a chain of pre-authentication trust decisions, each one a place where a party with authority acts on behalf of another party that has proven nothing. The reason MEV is so hard to make fair is not that the incentives are complex. It is that the trust boundary sits in the wrong place and nobody wants to move it, because the parties who benefit from the current ordering are the parties who would have to approve the change. Here is where the crypto industry's version is worse than the appliance's. The appliance is a closed system. You can, in principle, patch it. Crypto infrastructure is composable by design — and composability multiplies confused deputies. When protocol A trusts protocol B's state, and B trusts C's oracle, and C trusts an RPC gateway that trusts a relayer, you have built a chain of deputies, each acting on behalf of the last, and the trust boundary has been smeared across the entire stack. The SMA1000 has three exposed surfaces. A modern DeFi stack has three hundred, and every one of them is a potential pre-authentication decision made in the wrong order. Let me get concrete about what a pre-authentication audit looks like, because the phrase is useless without a procedure. Based on my audit experience, the methodology is a call-graph inversion. You do not start with the vulnerability; you start with the action. Enumerate every operation that produces a side effect — state change, value transfer, external call, privilege escalation. For each, walk backward along the call graph and ask one question at every hop: what has the caller proven at this point? If the answer is "nothing," you have found a pre-authentication action. The SMA1000's edge proxy fails this test at the first hop. So does Nomad's root initialization. So does every unguarded initialize function in every proxy contract ever deployed. The corollary is the one that makes this a design problem rather than a bug problem. You cannot fix a pre-authentication action by adding a check at the end of the call path. The check must precede the authority. And moving a check earlier in a mature system — whether it is firmware or a live contract — is a re-architecture, not a patch. That is why the SMA1000 shows the same opening move three times, and why I expect to see the same shape in crypto for years. Now, the defense-in-depth angle deserves its own paragraph, because the SMA1000 disclosure is unusually honest about how badly it failed. A pre-auth SSRF that leads to an authenticated command injection means the pre-auth layer was bypassed and the auth layer was also insufficient. A Zip Slip alongside a stored XSS means the input-validation layer and the output-encoding layer both failed. Four bug classes, four layers, all breached in one batch. In a healthy architecture, a single input-validation failure is contained by the layer beneath it. Here, the layers did not contain each other — they compounded. The same compounding risk exists in every DeFi stack that treats its layers as independent when they are actually a single trust surface. Your bridge's validator set, your oracle's deviation guard, your proxy's admin key, your RPC's rate limiter — if any one of them is the only thing standing between a pre-auth action and a drain, then you do not have defense in depth. You have defense in a single point, dressed up in four costumes. I want to be precise about the CVSS 10.0 here, because the number is doing rhetorical work in the advisory and it deserves a sober reading. A 10.0 is not "very bad." It is the maximum of the scale, and it means the vector is network-reachable, low-complexity, no-privileges-required, no-user-interaction, and high-impact across confidentiality, integrity, and availability. Translated into crypto terms: an unauthenticated, remotely reachable, deterministic path to full compromise. That is the profile of a bridge with an unguarded mint, of a proxy with a public initialize, of an RPC gateway whose routing table can be rewritten by an anonymous request. When I see a 10.0, I stop reading the CVSS and start reading the call graph, because the score tells me nothing the graph will not tell me better. And the recurrence is the real data point. One disclosure is an incident. Two is a pattern. Three, all opening with the same edge pre-auth SSRF, is a design record. The code remembers what the auditors missed, and what it remembers here is that the trust boundary has never been moved. If the three chains are homologous — same root cause, three patched instances — then every patch has been a tourniquet. If they are not homologous — three independent bugs sharing a shape — then the shape itself is the debt, and no amount of patching will retire it. Either way, the fix is the same, and it is not in the patch queue. It is in the architecture diagram. This is where the crypto comparison earns its keep. The industry has spent three years telling itself that audits are the answer — that if you get enough eyes on the bytecode, you are safe. The SMA1000 sequence is a counterexample that should be required reading. This is a product from a company whose entire business is security. It has a PSIRT. It has coordinated disclosure. It has CVE assignments. It has, by any process measure, done the right things. And it still shipped the same bug three times, because the process audits the code and not the trust boundary. The crypto industry has the same blind spot, magnified by the fact that its code is public and its trust boundaries are architectural and therefore invisible to a static analyzer. You can audit a function. You cannot audit a decision about where authentication belongs — unless someone writes it down and defends it, which almost nobody does. Let me bring in the composability angle explicitly, because it is the crypto-native twist on the confused deputy. Uniswap V4's hooks are the clearest case. Hooks turn the DEX into programmable Lego — that is the pitch, and it is accurate. But every hook is a callback that executes inside the pool's trust context, and the pool is the deputy. A hook that acts before verifying the caller, or that assumes a pool state that a prior hook has not yet finalized, is a pre-authentication action inside a composable system. The complexity spike here is not a developer-experience problem; it is a trust-surface problem. Ninety percent of developers will not reason correctly about when their hook executes relative to the pool's authentication of the swap, and the ones who do will be the ones the attackers study. Hooks are the SMA1000's /wsproxy with a governance token attached — an edge surface with authority, and a trust decision that must be made in the correct order. The same logic applies to the Layer2 landscape, and here I will be blunt about the structural picture. There are dozens of Layer2s and the same small user base — this is not scaling, it is slicing already-scarce liquidity into fragments. And each fragment is a new trust boundary, a new sequencer, a new bridge to the base layer, a new pre-authentication surface. Every rollup that ships is another confused deputy asking to be confused. The scaling narrative says "more capacity." The security reality says "more deputies, more boundaries, more places for authentication to sit on the wrong side of trust." When you fragment liquidity, you also fragment the security budget — and the smallest rollups, the ones with the least to spend on audits and monitoring, are exactly the ones operating the newest, least-battle-tested trust boundaries. That is not a scaling strategy. That is an attack-surface expansion wearing a scaling costume. Now the part the advisory's own framing tries to hide, and the part most crypto readers will miss because they are reading for the CVE and not the structure. The advisory leans hard on an "industry-commonality" frame. It points at Cisco FMC and NX-OS carrying similar vulnerabilities, and the implicit argument is: this is not a SonicWall problem, it is a boundary-device problem. I want to flag that this framing does two things at once, and only one of them is honest. The honest part: yes, pre-auth SSRF in edge appliances is a category-level disease, and the crypto industry has its own category-level version — every bridge, every gateway, every proxy. The dishonest part: "everyone does it" is a responsibility-diffusion move. It converts a specific architectural failure into a general condition, and general conditions do not trigger customer-replacement decisions the way specific failures do. Watch for the same move in crypto. When a bridge is drained and the post-mortem says "cross-chain messaging is hard," that is the industry-commonality frame doing its work — softening a specific trust-boundary failure into a category-wide inevitability. It is the most effective way to avoid ever fixing the design record. The second contrarian point is about the source itself, and it is the kind of thing I only flag after I have verified the mechanics, because a credibility problem in the framing does not invalidate a correct technical argument — but it changes what you can build on. The advisory carries several attribution anomalies that do not survive contact with public record. A researcher credited to one organization appears, on public knowledge, to belong to a different one. A single individual is assigned to two different firms in the same document. The CVE numbering spans an implausible range — a six-digit identifier, 102255, sitting alongside 15409, in the same sequence. These are the fingerprints of synthesized or transcription-corrupted content. That does not mean the underlying SonicWall advisory is fake; it may well be a garbled restatement of a real disclosure. It means the specific names and numbers cannot be treated as fact, and any downstream decision built on them inherits the uncertainty. The lesson for crypto readers is direct: in a market where a single thread can move a token, the provenance of the intelligence matters as much as its content. The code remembers what the auditors missed, and the ledger remembers who trusted an unverified source. The security-vendor paradox sits underneath both points. A security vendor's brand is its product. The more attackers target a boundary appliance, the more it proves the appliance is widely deployed — which is a kind of market validation — and simultaneously the more it exposes the architecture. The vendor cannot win the narrative. Neither can a bridge. The most-attacked bridges are, by one reading, the most-used; by another, the most-fragile. Crypto has not developed a vocabulary for holding both truths, so it oscillates between "audited, therefore safe" and "hacked, therefore dead," and misses the only question that matters: is the trust boundary moving toward the correct order, or is it standing still while the patches accumulate? Here is my forward judgment, stated as a forecast rather than a summary. The SMA1000 will very likely produce a fourth disclosure cycle. The shape is stable, the trust boundary has not moved, and mature hardware lines do not get re-architected on the schedule that security requires. The signal to watch is not the next CVE — it is whether the opening move changes. If the fourth cycle opens with anything other than an edge pre-authentication SSRF, the boundary has finally been redrawn. If it opens the same way, the debt is structural and the only rational operator response is migration, not patching. Patching the silence between protocol updates is not a security strategy; it is a way of measuring how long a boundary has gone unmoved. For crypto, the forecast is the same shape at larger scale. The next major bridge or gateway exploit will not be a cryptographic break. It will be a confused deputy — a pre-authentication action taken in the wrong order — and the post-mortem will reach for the industry-commonality frame before it reaches for the architecture diagram. The question I leave you with is the one I ask of every protocol I audit: when your system acts with authority, what has the caller proven at that exact moment? If the answer is "nothing," you have not found a bug. You have found the design.