it sounds to me like the fix would be create a new map that maps account ID -> tokens, where account ID = the "sender" account where the tokens came from, and do the migration to move these 'orphaned' tokens into the right buckets.
admittedly I guess that would break everything/trust if someone can just rewrite the code to say who has what tokens!
There are actually some approaches that makes smart contracts "upgradeable" but it involves using a special base class that proxies everything through delegate calls.
But yeah you're definitely right about the nature of the contracts being immutable, unless that immutable code contains some setter that delegates the function calls to some other contract.
ERC-721 (NFTs) actually has a nice way of dealing with sending NFTs to an incorrect address by checking if it implements a special interface if the recipient is a smart contract. But any measures come at the cost of extra gas so they are usually avoided.
Doesn't the WETH smart contract store all the tokens it receives at its address? Doesn't anyone have the private key of that address?
It's been quite a long time since I have been playing with smart contracts and I don't actually remember what happens when a smart contract is created.
Don't know the code for specific code for that contract but contract wrapping/unwrapping doesn't necessarily imply that anyone can withdraw ethers sent via normal means. If the contract is upgradeable it would be possible but being upgradeable should be built into the contract first.
From what I understand smart contracts are immutable, so this "bug" can only be fixed by publishing a new contract which is by definition independent from the old, i.e. unable to access or manipulate any tokens (like these) that belonged to the old one.
Additionally, apparently contracts may rely upon one another, and a bunch of the contacts that utilize this WETH token depend upon the existing contract. All of these (and their dependents, recursively) would also need to be updated.
I.e. the money is gone unless there is a large concerted effort, but no one should reasonably expect this.
it sounds to me like the fix would be create a new map that maps account ID -> tokens, where account ID = the "sender" account where the tokens came from, and do the migration to move these 'orphaned' tokens into the right buckets.
admittedly I guess that would break everything/trust if someone can just rewrite the code to say who has what tokens!