Skip to content

Delegatecall to Untrusted / Arbitrary Target

SAFE-0028 External Calls Checked automatically by the scanner
1

What goes wrong

delegatecall executes external code in the CURRENT contract's storage context. If the target is attacker-influenced, it can rewrite storage (including owner) or selfdestruct the caller.

2

How to fix it

the pattern that is safe
address public immutable impl;
constructor(address _impl){ impl = _impl; }
function exec(bytes calldata d) external onlyOwner {
    (bool ok,) = impl.delegatecall(d); require(ok);
}
Parity wallet self-destruct (2017). Restrict delegatecall targets.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0028 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs