Storage Collision in Proxy / Delegatecall

SAFE-0033 Upgradeability Checked automatically by the scanner

What goes wrong

Proxy and implementation (or two delegatecall partners) define storage variables at the same slots with different meanings. Writes intended for one variable corrupt another, including admin/owner slots.

How to fix it

the pattern that is safe

// EIP-1967: admin/impl at keccak-derived slots; logic storage starts clean
bytes32 constant _ADMIN_SLOT = 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103;

◆

Use EIP-1967 / OZ TransparentProxy; preserve layout.

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$1.43B · 2025 Bybit Access control · 2025 $624M · 2022 Ronin Network Access control · 2022 $611M · 2021 Poly Network Access control · 2021 $291M · 2026 KelpDAO rsETH Access control · 2026

Related vulnerabilities in Upgradeability

SAFE-0034Upgradeable Storage Layout Corruption critical · Upgradeability SAFE-0035UUPS Upgrade Authorization Bug critical · Upgradeability SAFE-0036Proxy Admin Takeover critical · Upgradeability SAFE-0233UUPS _authorizeUpgrade Unprotected critical · Upgradeability SAFE-0129State Initialised in Constructor of Upgradeable Contract high · Upgradeability SAFE-0230Proxy / Implementation Storage Layout Collision high · Upgradeability SAFE-0234immutable Variable Reads Zero Through Proxy high · Upgradeability SAFE-0128Upgradeable Base Missing Storage Gap medium · Upgradeability

← PreviousMemory Corruption in Assembly Next →Upgradeable Storage Layout Corruption

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0033 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs