feat: Delegate call and proxy pattern vulnerability detection (CP-118)

[Nanle-code]

Overview

Proxy and upgrade patterns are ubiquitous in modern DeFi — UUPS, Transparent Proxy, Beacon, and Diamond (EIP-2535). Each introduces unique vulnerabilities around delegatecall, storage layout collisions, and unprotected upgrade functions. ChainProof currently has no coverage for these patterns.

Vulnerability Patterns to Detect

1. Storage Slot Collision

// Proxy.sol
contract Proxy {
    address public implementation; // slot 0

// Implementation.sol
contract Implementation {
    address public owner; // also slot 0 — COLLISION
}

2. Unprotected _authorizeUpgrade

function _authorizeUpgrade(address newImpl) internal override {} // empty body

3. Uninitialized Implementation Contract

initialize() callable by anyone on the implementation directly — attacker sets themselves as owner, then calls selfdestruct. (Parity hack pattern)

4. delegatecall to User-Controlled Address

function execute(address target, bytes calldata data) external {
    target.delegatecall(data); // attacker supplies malicious target
}

5. Function Selector Clashing (Diamond Proxy)

Two facets registering the same 4-byte selector, causing one to shadow the other.

Detection Approach

1. Identify proxy patterns via storage variable naming heuristic
2. Detect delegatecall to non-constant address
3. Check _authorizeUpgrade and upgradeTo for access control guards
4. Detect storage layout conflicts by enumerating slot 0 in proxy vs implementation
5. Flag uninitialized implementation contracts

Acceptance Criteria

• CP-118 rule in packages/core/src/rules/cp118-proxy-delegate.ts
• All 5 patterns detected with Critical/High severity
• Proxy pattern auto-detection heuristic
• Storage slot collision detection
• Vulnerable UUPS proxy example in examples/contracts/proxy/
• Secure UUPS proxy with OpenZeppelin pattern in same folder

References

• EIP-1967
• EIP-2535 Diamond
• Parity Wallet Hack Postmortem

[Babigdk]

Proposal: CP-118 Proxy & Upgrade Pattern Security Rule

I’d like to implement detection coverage for proxy and upgrade-related vulnerabilities in ChainProof.

Scope of Work:

• Implement cp118-proxy-delegate.ts rule in packages/core/src/rules/

• Detect proxy patterns (UUPS, Transparent, Beacon, Diamond) via heuristics

• Flag key vulnerabilities:

  • Storage slot collisions (e.g., slot 0 conflicts)
  • Unprotected _authorizeUpgrade / missing access control
  • Uninitialized implementation contracts (Parity-style takeover risk)
  • Unsafe delegatecall to user-controlled addresses
  • Diamond selector collisions (4-byte function selector overlap)

• Add proxy pattern detection heuristics for contract classification

• Include severity mapping (Critical / High based on exploitability)

• Add vulnerable + secure proxy examples under examples/contracts/proxy/

Deliverables:

• CP-118 rule implementation
• Proxy detection + analysis engine
• Test suite covering all 5 vulnerability patterns
• Example contracts (vulnerable + OpenZeppelin-secure UUPS version)
• Integration with existing rule reporting system

Goal:
Improve ChainProof coverage for modern upgradeable DeFi architectures and prevent common proxy-based exploit classes.

[Vibeofkd]

Hi I’d love to work on this issue

[grantfox-oss]

🦊 GrantFox — @Vibeofkd has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #14)
2. Your PR will be reviewed by the StellarChainproof maintainers

Good luck! Track your progress on GrantFox.