CALL and CALLCODE take the same number of operands (in the execution stack). For the exception flag being pushed on top of the stack: 0 means exception, 1 means successful execution. CALL is easy to understand, but I could not digest the subtle difference between CALL & CALLCODE. It is stated in the yellow paper that for

CALLCODE: This means that the recipient is in fact the same account as at present, simply that the code is overwritten.

What does it mean by the code is overwritten? Does that mean I can ask the contract to execute some external code? It would be helpful if anyone can provide me an example to differentiate between the two.

EDIT: DELEGATECALL was added in Homestead what is the difference?

up vote 57 down vote accepted

DELEGATECALL basically says that I'm a contract and I'm allowing (delegating) you to do whatever you want to my storage. DELEGATECALL is a security risk for the sending contract which needs to trust that the receiving contract will treat the storage well.

DELEGATECALL was a new opcode that was a bug fix for CALLCODE which did not preserve msg.sender and msg.value. If Alice invokes Bob who does DELEGATECALL to Charlie, the msg.sender in the DELEGATECALL is Alice (whereas if CALLCODE was used the msg.sender would be Bob).


When D does CALL on E, the code runs in the context of E: the storage of E is used.

When D does CALLCODE on E, the code runs in the context of D. So imagine that the code of E is in D. Whenever the code writes to storage, it writes to the storage of account D, instead of E.

contract D {
  uint public n;
  address public sender;

  function callSetN(address _e, uint _n) {"setN(uint256)")), _n); // E's storage is set, D is not modified 

  function callcodeSetN(address _e, uint _n) {
    _e.callcode(bytes4(sha3("setN(uint256)")), _n); // D's storage is set, E is not modified 

  function delegatecallSetN(address _e, uint _n) {
    _e.delegatecall(bytes4(sha3("setN(uint256)")), _n); // D's storage is set, E is not modified 

contract E {
  uint public n;
  address public sender;

  function setN(uint _n) {
    n = _n;
    sender = msg.sender;
    // msg.sender is D if invoked by D's callcodeSetN. None of E's storage is updated
    // msg.sender is C if invoked by None of E's storage is updated

    // the value of "this" is D, when invoked by either D's callcodeSetN or

contract C {
    function foo(D _d, E _e, uint _n) {
        _d.delegatecallSetN(_e, _n);

When D does CALLCODE on E, msg.sender inside E is D as commented in the code above.

When an account C invokes D, and D does DELEGATECALL on E, msg.sender inside E is C. That is, E has the same msg.sender and msg.value as D.

You can quickly test above in Solidity Browser.

  • Thanks for the answer, but this is semantic is strange though. For example, I will never deposit my money to any contract which has such callcode operator. What can prevent someone from executing (send money out of the contract to some different address) in the callcode? – Loi.Luu May 7 '16 at 8:32
  • 1
    Maybe worth posting as another question to get other perspectives, but usually both contracts D and E would be written by same person, and you would probably only deposit money to a contract D that you trusted. You're right, any contract D that does CALLCODE of another contract E must be careful of what E does, and anyone using D should also be cautious. – eth May 8 '16 at 0:22
  • Can you also explain DELEGATECALL? – Paweł Bylica May 18 '16 at 20:07
  • @PawełBylica Added DELEGATECALL and hope it's still clear. – eth May 19 '16 at 10:41
  • 1
    @TravisJacobs Yes. Added a line to the answer (and tested it). – eth Sep 21 '17 at 8:50

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.