blockchains-security-toolkit/vulnerabilities/delegatecall

Attacks via code injection with DELEGATECALL

🖤 This is my favorite vuln

---

TL;DR

1. Call to untrusted contracts may introduce unexpected risks and errors.
2. External calls controlled by an attacker may force a contract to transition into an undefined state.
3. Types of external calls: STATIC CALL and DELEGATE CALL.
4. Using DELEGATE CALL, contract can preserve the storage state while using the logic of the contract. This introduces the concept of Proxies.
5. The proxy contract redirects all the calls it receives to an "logic contract", whose address is stored in its "proxy contract". The proxy runs the "logic contract"'s code as its own (modifying its storage and the balance of the "proxy contract").

---

Learning resources

• SWC docs on DELEGATECALL
• Sigma Prime post on DELEGATECALL