delegate-call-risks

Identify delegatecall risks in Solidity proxy contracts.

120|12|Updated Apr 10, 2026
One-click install
npx skills add https://github.com/ccashwell/evm-cortex --skill delegate-call-risks
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: delegate-call-risks
Source: https://github.com/ccashwell/evm-cortex/tree/main/skills/delegate-call-risks
Command: npx skills add https://github.com/ccashwell/evm-cortex --skill delegate-call-risks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Delegatecall is a powerful but dangerous pattern in Solidity that can compromise storage integrity, context, and initialization safety when used in proxies or modular contracts. This skill outlines the risks and the patterns needed to implement safe upgradeable architectures and avoid common pitfalls.

Core Features & Use Cases

  • Storage-layout integrity: ensure proxy and implementation share identical storage layouts to prevent slot collisions.
  • Context preservation: maintain the caller and value context correctly when delegating calls.
  • Initialization safety: disable or guard initialize functions to prevent unauthorized access to proxy logic.
  • Upgrade patterns awareness: recognize and safely implement UUPS/Transparent and Diamond-style upgrade patterns.
  • Security-first practices: apply a defensive checklist to reduce risk in real-world deployments.

Quick Start

Audit your Solidity proxy implementations and apply the delegatecall safety patterns to ensure storage layouts, context preservation, and proper initialization controls.

Frequently Asked Questions about delegate-call-risks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What are the main delegatecall risks in Solidity proxy contracts?

To prevent storage slot collisions during a contract upgrade, ensure proxy and implementation contracts share an identical storage layout. This skill provides defensive checklists to verify storage-layout integrity and avoid overwriting critical state variables across delegate calls.

How do I secure initialize functions in upgradeable contracts?

Secure initialize functions in upgradeable contracts by applying initialization guards that disable or restrict access after initial setup. This skill helps you implement these safety controls to prevent unauthorized execution of proxy initialization logic.

Does this skill cover both UUPS and Diamond proxy patterns?

Yes, this skill covers safe delegatecall usage across both UUPS and Diamond-patterned architectures. It provides security-first practices for recognizing and safely implementing these specific upgrade patterns while maintaining context preservation.

When do I need to audit delegatecall usage for context preservation?

You need to audit delegatecall usage when maintaining caller and value context across modular or proxy contracts. This skill helps verify that execution context is preserved correctly when delegating calls to prevent context-related vulnerabilities.

What is the best way to verify safe upgradeable patterns in Solidity?

The best way to verify safe upgradeable patterns is applying a defensive security checklist focused on storage matching, initialization guards, and context preservation. This skill outlines the patterns needed to implement safe architectures and avoid common pitfalls.