# Malicious strategy can lead to loss of funds

AdapterBase delegatecalls into Strategy, letting a malicious strategy overwrite adapter storage slots like performanceFee and highWaterMark to steal funds.

- Payout: Contest reward
- Severity: high
- Program: Popcorn
- Credited: 7siech
- Disclosed: 2023-09-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/388
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** BeefyAdapter / AdapterBase strategy delegatecall
**Root cause:** AdapterBase invokes the Strategy via delegatecall, so the strategy executes in the adapter's storage context and can write arbitrary slots such as performanceFee and highWaterMark.
**Steps:**
1. Deploy a MaliciousStrategy implementing the expected strategy interface.
2. Pair it with BeefyAdapter so harvest() delegatecalls into it.
3. Inside the strategy, compute adapter storage slots (performanceFee, highWaterMark) via the Adapter helper.
4. Write attacker-controlled values to those slots during the delegatecall.
5. Call harvest() and observe manipulated fee/watermark values in the log output.
**How found:** Code reading of AdapterBase revealed delegatecall into Strategy, prompting the hypothesis that strategy code shares adapter storage; confirmed by writing a MaliciousStrategy and Foundry test that mutates performanceFee/highWaterMark.
**Exploitation:** A malicious strategy, once paired with an adapter, executes in the adapter's storage context via delegatecall and rewrites performanceFee/highWaterMark (or any slot) to redirect fees and inflate payouts, or make arbitrary external calls as the adapter.
**Escalation:** Any adapter storage slot or external call on behalf of msg.sender can be hijacked, not just fee parameters.
**Insight:** When a contract delegatecalls into a pluggable/upgradeable component, treat that component as fully trusted for storage; check whether 'mix and match' plugin designs let an untrusted plugin rewrite fee, watermark, or owner slots.