delegatecall executes external code in this contract's storage and with its balance. When the target address (or the calldata selecting it) comes from user input, an attacker points it at a contract that overwrites the owner slot or calls selfdestruct, taking over or bricking the contract.
// function exec(address to, bytes data) public { to.delegatecall(data); } // attacker deploys Evil{ function pwn() public { owner = attacker; } } // exec(Evil, abi.encodeWithSignature("pwn()")) -> owner overwritten.
// only delegatecall to a fixed, trusted, immutable implementation address impl = _implementation(); // not user-supplied (bool ok,) = impl.delegatecall(data); require(ok);
Incidents this entry cites by name:
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0117 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.