Delegatecall Vulnerability
A delegatecall vulnerability occurs when a smart contract uses the delegatecall opcode to execute code from an untrusted or improperly managed contract. Unlike a standard call, delegatecall executes the code of the target contract within the context of the calling contract, meaning it can modify the calling contract's storage.
If the target contract is malicious or has vulnerabilities, it can overwrite the caller's storage, leading to loss of funds or total system compromise. This is a frequent issue in upgradeable proxy patterns if the proxy is not implemented correctly.
Developers must ensure that any contract called via delegatecall is fully audited and immutable, or protected by strict access controls. It is one of the most dangerous patterns in Solidity development, requiring deep knowledge of the EVM execution context.