A delegatecall executes inside a loop, often over caller-supplied targets or calldata (multicall/batch). Each iteration runs foreign code in this contract's storage context; one malicious entry can overwrite owner/critical slots or brick the batch.
// for (uint i; i < calls.length; i++) { impl.delegatecall(calls[i]); } // one crafted element calls a function that sets owner = attacker in THIS // contract's storage — full takeover mid-batch.
// avoid delegatecall in loops; if batching, delegatecall only to a fixed, // trusted, immutable implementation and validate every element first.
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0302 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.