Skip to content

Commit

Permalink
Update delegatecall-untrusted-callee.md
Browse files Browse the repository at this point in the history
  • Loading branch information
kadenzipfel authored Jul 28, 2024
1 parent 1930d24 commit 0e2cdb1
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions vulnerabilities/delegatecall-untrusted-callee.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ contract Attack {
}
```

In this example, the `Proxy` contract uses `delegatecall` to forward any call it receives to an address provided by the user. The `Target` contract contains a to call the `pwn()` function that changes the owner of the contract to the caller.
In this example, the `Proxy` contract uses `delegatecall` to forward any call it receives to an address provided by the user. The `Target` contract contains a call to the `pwn()` function that changes the owner of the contract to the caller.

The `Attack` contract takes advantage of this setup by calling the `forward` function of the `Proxy` contract, passing the address of the `Target` contract and the encoded function call `pwn()`. This results in the `Proxy` contract's storage being modified, specifically the `owner` variable, which is set to the attacker’s address.

Expand All @@ -62,4 +62,4 @@ To mitigate the risks associated with `delegatecall` to untrusted callees, consi
- [SWC Registry: SWC-112](https://swcregistry.io/docs/SWC-112)
- [Solidity Documentation: Delegatecall](https://docs.soliditylang.org/en/latest/introduction-to-smart-contracts.html#delegatecall-and-libraries)
- [Sigma Prime: Solidity Security](https://blog.sigmaprime.io/solidity-security.html#delegatecall)
- [Ethereum Stack Exchange: Difference Between Call, Callcode, and Delegatecall](https://ethereum.stackexchange.com/questions/3667/difference-between-call-callcode-and-delegatecall)
- [Ethereum Stack Exchange: Difference Between Call, Callcode, and Delegatecall](https://ethereum.stackexchange.com/questions/3667/difference-between-call-callcode-and-delegatecall)

0 comments on commit 0e2cdb1

Please sign in to comment.