Skip to content

Latest commit

 

History

History
10 lines (7 loc) · 800 Bytes

11.md

File metadata and controls

10 lines (7 loc) · 800 Bytes

Delegatecall to Untrusted Callee

Description:

There exists a special variant of a message call, named delegatecall which is identical to a message call apart from the fact that the code at the target address is executed in the context of the calling contract and msg.sender and msg.value do not change their values. This allows a smart contract to dynamically load code from a different address at runtime. Storage, current address and balance still refer to the calling contract.

Remediation:

Use delegatecall with caution and make sure to never call into untrusted contracts. If the target address is derived from user input ensure to check it against a whitelist of trusted contracts.

References:

https://swcregistry.io/docs/SWC-112