hard20 pts · first answer countssecurityevm

delegatecall to user input

Why is a function like execute(address target, bytes data) that does target.delegatecall(data) extremely dangerous if anyone can call it?

A.The called code runs in the caller's storage context, so an attacker's contract can overwrite the owner, drain funds or selfdestruct-style break logicB.delegatecall always costs more than 1 ETHC.delegatecall only works with view functionsD.It is safe because delegatecall cannot change storage

← Paying everyone in a loop Account abstraction →