Crypto glossary
Delegatecall
Delegatecall is an EVM call that runs another contract's code inside the caller's own storage and context; it powers proxies and many exploits.
A normal CALL executes code in the target contract, which reads and writes its own storage. DELEGATECALL borrows only the target's code: it runs in the context of the calling contract, using the caller's storage, balance and address, and it keeps the original msg.sender. In effect, the caller temporarily adopts someone else's logic as if it were its own.
This is what makes upgradeable contracts possible. A proxy holds the funds and data, and forwards every call by delegatecall to an implementation contract that can be swapped for a new version. Smart account wallets, libraries and many DeFi protocols rely on the same trick to share code and save deployment costs.
The power is also the danger. If an attacker can make a contract delegatecall into code they control, that code can overwrite storage, change the owner or move every asset. The 2017 Parity multisig freeze and the 2025 Bybit theft both involved delegatecall paths, and storage layout mismatches between proxy and implementation are a classic audit finding.
Example
In a multisig wallet, a transaction disguised as a routine transfer is actually a delegatecall to a malicious contract that rewrites the wallet's implementation address and hands control to the attacker.