delegatecall executes external code in the CURRENT contract's storage context. If the target is attacker-influenced, it can rewrite storage (including owner) or selfdestruct the caller.
address public immutable impl;
constructor(address _impl){ impl = _impl; }
function exec(bytes calldata d) external onlyOwner {
(bool ok,) = impl.delegatecall(d); require(ok);
}
Incidents this entry cites by name:
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0028 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.