--- title: "EVM Deep Dive: Unrestricted delegatecall and Proxy Hijacking" url: https://daily.dev/posts/evm-deep-dive-unrestricted-delegatecall-and-proxy-hijacking-mftlvzivy source_url: https://coinsbench.com/evm-deep-dive-unrestricted-delegatecall-and-proxy-hijacking-82b982efec71 type: article source: "Coins Bench" published: 2026-08-24T12:46:37.786Z updated: 2026-08-24T12:47:32.378Z tags: ["ethereum", "smart-contracts", "solidity"] reading_time: 2 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EVM Deep Dive: Unrestricted delegatecall and Proxy Hijacking **[Coins Bench](https://daily.dev/sources/coinsbench)** · 2 min read · 0 upvotes · 0 comments ## Summary Explains how unrestricted delegatecall in proxy contracts allows attackers to hijack ownership by exploiting storage layout mismatches between logic and proxy contracts. Walks through the difference between call and delegatecall execution contexts, shows a vulnerable Solidity proxy example based on Ethernaut's Delegation challenge, and traces the attack flow step by step showing how an attacker overwrites the owner slot. Recommends whitelisting selectors and aligning storage layouts as defenses. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can an unrestricted delegatecall in a proxy contract lead to an ownership takeover? When a proxy's fallback function forwards arbitrary calldata to a logic contract via delegatecall without validation, the logic contract's code executes inside the proxy's storage context. If a logic function writes to a storage slot that also holds the proxy's owner variable, an attacker can call that function directly to overwrite the owner slot with their own address, seizing control of the proxy. _Track smart contract vulnerability patterns like this delegatecall exploit through daily.dev before auditing your own proxies._ ### What is the difference between call and delegatecall in Solidity regarding storage context? Call executes code in the target contract's own storage context, so storage writes land in the target and msg.sender becomes the calling contract. Delegatecall instead borrows only the target's code while storage writes redirect back into the calling contract's storage slots, and msg.sender and msg.value remain unchanged from the original caller. _Developers comparing execution semantics like these can follow Solidity security deep dives on daily.dev._ ### How do I defend a Solidity proxy contract against delegatecall storage collision attacks? Restrict delegatecall proxies to explicitly whitelisted function selectors or implement strict access controls on target implementation contracts, and ensure logic contracts and proxy contracts share identical storage slot layouts to prevent accidental state corruption from mismatched slots. _daily.dev surfaces defensive coding practices for engineers hardening proxy-based upgradeable contracts._ ## Similar posts on daily.dev - [\[Ethernaut\] 6. Delegation](https://daily.dev/posts/ethernaut-6-delegation-dtsmkk1ry) · Coins Bench · 0 upvotes · 0 comments - [Damn Vulnerable DeFi Challenges 2 Naive receiver Walkthrough](https://daily.dev/posts/damn-vulnerable-defi-challenges-2-naive-receiver-walkthrough-yxvr17ys9) · Coins Bench · 0 upvotes · 0 comments - [Smart Contract: Hands-on Exploration](https://daily.dev/posts/smart-contract-hands-on-exploration-jrgxhshls) · Coins Bench · 0 upvotes · 0 comments --- Tags: [#ethereum](https://daily.dev/tags/ethereum), [#smart-contracts](https://daily.dev/tags/smart-contracts), [#solidity](https://daily.dev/tags/solidity) [View this post on daily.dev](https://daily.dev/posts/evm-deep-dive-unrestricted-delegatecall-and-proxy-hijacking-mftlvzivy)