0

Let's say that I have the bytecode of a smart contract deployed on ethereum (which I got with a call to eth_getCode).

How can I programmatically determine if this smart contract uses delegatecall anywhere?

I don't want to have to rely on etherscan for this sort of task, especially since I need this done programmatically as part of a longer script to determine if an arbitrary token is safe to buy or not.

Thank you.

1 Answer 1

2

The basic idea is that you're scanning for the DELEGATECALL (F4) opcode, to do that you have to find an f4 in your code that isnt data being pushed (You can push up to 32 bytes through the PUSH1-PUSH32 (0x60 - 0x7f) instructions). A simple implementation is

  • run through the bytecode,
  • for every group of 2 characters,
    • if it's delegatecall, return true
    • if it's a PUSHX, jump the correct amount of character
    • if it's anything else, jump to the next group of 2 characters.

Here's a simple impl i quickly wrote in python

def isDelegateCall(bytecode):
    i = 0
    while i < len(bytecode):
        opcode = int(bytecode[i:i+2], 16)
        if opcode == 244: # DELEGATECALL
            return True
        elif opcode >= 96 and opcode <= 127: # Range of PUSHX instructions
            i += (opcode - 96) * 2 + 2 
        i += 2
    return False

print(isDelegateCall("3d602d80600a3d3981f3363d3d373d3d3d363d73bebebebebebebebebebebebebebebebebebebebe5af43d82803e903d91602b57fd5bf3")) # Test with minimal proxy

3
  • Thank you for the thorough response, that made total sense! You used the term "simple implementation" a couple of times. Would you say that a contract contains delegatecall if and only if your python function returns true, or are there weird corner cases that it doesn't cover which caused you to use that term?
    – galpo
    Sep 1, 2023 at 22:55
  • 1
    I said "simple" because it's not complicated and probably could be done more efficiently, but there is indeed an edge case i'm not considering, that's the compiler-added contract metadata (docs.soliditylang.org/en/v0.8.17/metadata.html), for compiled contracts, that you'd have to ignore if it's present.
    – Foxxxey
    Sep 2, 2023 at 12:22
  • And also, my code tells you that there's a delegatecall opcode, not that its actually reachable, That would be a much harder thing to code.
    – Foxxxey
    Sep 2, 2023 at 12:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.