Arbitrary Target Execution

Arbitrary target execution is a vulnerability where an attacker can influence the destination address of a delegatecall or call, allowing them to execute code in an unintended contract. This is often caused by insufficient validation of user-provided addresses.

If an attacker can point the call to a contract they control, they can steal assets or manipulate the state of the calling contract. Security audits prioritize the strict validation of all external address inputs to prevent this.

Using allowlists or hard-coded target addresses is the most effective defense. This vulnerability is a classic example of the risks associated with dynamic contract interaction in DeFi.