Controlled delegatecall

Severity: High ID: controlled-delegatecall

delegatecall executes code from another address in the caller's storage and execution context. This lint detects delegatecall targets that are not provably trusted, including targets that can be influenced by users, mutable storage, or constructor-provided values.

What it does

This lint flags delegatecall where the destination is not provably a trusted literal, constant, zero address, or address(this). It tracks local aliases, simple helper returns, local equality guards against trusted values, and modifier guards that refine the target argument before _. Function parameters, msg.sender, mutable state variables, mapping and array reads, local aliases of those values, and all immutables are treated conservatively as untrusted.

This lint does not attempt to prove trust through access-control modifiers such as onlyOwner, role checks, allowlist mappings, implementation-slot reads, assembly, external/library predicate helpers, codehash checks, or constructor-initialized immutables. Those patterns may be safe in a specific system, but they are intentionally outside this lint's proof model and can still warn.

Why is this bad?

A controlled delegatecall target can run arbitrary code against the calling contract's storage. An attacker-controlled implementation can overwrite state, bypass invariants, drain funds, or destroy the contract.

Example

Bad

contract Delegatecall {
    function delegate(address target, bytes calldata data) external {
        target.delegatecall(data);
    }
}

Good

contract Delegatecall {
    address public constant IMPLEMENTATION = 0x000000000000000000000000000000000000dEaD;

    function delegate(bytes calldata data) external {
        IMPLEMENTATION.delegatecall(data);
    }
}

Configuration

This lint has no additional configuration.