delegate-call-risks

Delegatecall Risks

How Delegatecall Works

delegatecall executes the target's code in the caller's context: the caller's storage, msg.sender, msg.value, and address(this) are preserved.

Proxy (storage)  →  delegatecall  →  Implementation (code)
- slot 0: admin      executes in       reads/writes Proxy's storage
- slot 1: value      Proxy context      msg.sender = original caller

Storage Layout Must Match

The proxy and implementation must have identical storage layouts. Delegatecall operates on slot numbers, not variable names.

// PROXY storage layout:
// slot 0: address admin
// slot 1: uint256 totalDeposits

// Implementation V1 — MUST match proxy layout
contract VaultV1 {
    address public admin;        // slot 0 ✓
    uint256 public totalDeposits; // slot 1 ✓
}

// Implementation V2 — DANGEROUS: inserted variable shifts layout
contract VaultV2Bad {
    address public admin;           // slot 0 ✓
    address public feeRecipient;    // slot 1 ✗ (was totalDeposits!)
    uint256 public totalDeposits;   // slot 2 ✗ (shifted!)
}

// Implementation V2 — SAFE: appended variable
contract VaultV2Good {
    address public admin;           // slot 0 ✓
    uint256 public totalDeposits;   // slot 1 ✓
    address public feeRecipient;    // slot 2 (new, appended)
}

Context Preservation

Inside a delegatecall, all context variables refer to the proxy:

contract Implementation {
    function whoAmI() external view returns (address self, address sender, uint256 val) {
        self = address(this);    // proxy address (NOT implementation)
        sender = msg.sender;     // original caller (NOT proxy)
        val = msg.value;         // original value sent to proxy
    }
}

Proxy Initialization Attack

If the implementation contract's initialize() isn't disabled, an attacker can call it directly.

// VULNERABLE: implementation can be initialized
contract VaultImpl is Initializable {
    function initialize(address admin) external initializer {
        _admin = admin;
    }
}
// Attacker calls VaultImpl.initialize(attackerAddress) directly

// SAFE: disable initializers in constructor
contract VaultImpl is Initializable {
    /// @custom:oz-upgrades-unsafe-allow constructor
    constructor() {
        _disableInitializers();
    }

    function initialize(address admin) external initializer {
        _admin = admin;
    }
}