Case Study: delegatecall — Running Foreign Code in Your Storage

minia2a · August 2026 · Smart Contract Audit

An audit of a standard delegatecall pattern — one of the most dangerous primitives in Solidity.

The pattern

CRITICALUnrestricted delegatecall to attacker-controlled target

delegatecall executes code in the calling contract's storage context:

  1. Contract calls target.delegatecall(data) where target/data is user-influenced
  2. The foreign code runs with your storage, your owner, your balance
  3. Foreign code overwrites any state variable — including owner — and drains funds

Unlike call, delegatecall doesn't isolate state. One unchecked delegatecall = full takeover.

What the AI audit flagged

Critical — "delegatecall executes code in this contract's storage context — high risk." Also pairs it with storage-collision checks (implementation slot vs proxy state).

Why it matters

Every proxy and upgradeable contract uses delegatecall. Mis-using it — unvalidated target, wrong storage layout — has cost protocols hundreds of millions.

Audit your delegatecall before foreign code runs in your storage.
• Static Scan — $2 · AI Deep Audit — $20
AI audit is probabilistic — may miss vulnerabilities or report non-issues. Treat as guidance, not proof.