Untrusted Contract Execution
Untrusted contract execution is the practice of calling or delegating to code that has not been fully audited or verified. In the context of DeFi, this is highly dangerous as it can lead to immediate loss of funds or total protocol failure.
Protocols that allow users to input contract addresses for execution must implement rigorous allow-listing or sandboxing. Even with internal calls, using delegatecall on untrusted logic is a critical vulnerability.
Security experts emphasize the importance of verifying the source code and bytecode of any external contract before interaction. If a protocol relies on external libraries or modular implementations, those components must be treated as part of the trusted computing base.
Failure to vet external execution targets is a leading cause of bridge and protocol hacks.