delegatecall with user-controlled target
Veda (BoringVault)'s assessment for RD-F-012 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
BoringVault's manage() calls target.functionCallWithValue(data, value) with requiresAuth guard. ManagerWithMerkleVerification passes strategist-supplied targets through merkle-proof verification before reaching vault.manage(). Merkle root is set by authorized admin only. This is NOT user-controlled delegatecall in the Parity-multisig sense — the allowlist is the merkle tree. However, calldata is partially user-sourced (strategist-supplied) even if target-constrained by merkle. Audited in A-4 with no critical findings. Yellow for architectural complexity rather than a direct exploit pattern.
Sources #
- GitHubBoringVault.sol — manage() functionBoringVault.sol manage() function — requiresAuth gated external callretrieved 2026-05-17
- ManagerWithMerkleVerification.sol — manage pathManagerWithMerkleVerification.sol — merkle-gated target validationretrieved 2026-05-17
- Seven Seas A-4 — manage() architecture reviewedA-4 reviewed this architecture — no critical findings on manage() pathretrieved 2026-05-17
Methodology #
Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.
See the full factor methodology and distribution across all protocols →