# AdapterBase should always use delegatecall to call the functions in the strategy

AdapterBase calls strategy verify/setUp functions with call instead of delegatecall, so strategy context lacks adapter interface and vault creation fails or misconfigures.

- Payout: Contest reward
- Severity: medium
- Program: Popcorn
- Credited: cccz
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/435
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-21
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** AdapterBase strategy setup (Solidity vault adapter)
**Root cause:** Strategy contracts expect to be invoked via delegatecall so address(this) is the Adapter; _verifyAndSetupStrategy uses plain call, making address(this) the strategy, which lacks the adapter interface.
**Steps:**
1. Strategy harvest() calls IAdapter(address(this)).strategyConfig() relying on delegatecall context.
2. AdapterBase._verifyAndSetupStrategy invokes strategy.verifyAdapterSelectorCompatibility/verifyAdapterCompatibility/setUp via call.
3. Inside these, IAdapter(address(this)).asset() reverts since strategy doesn't implement adapter interface.
4. Vault creation with that strategy fails; or if setup succeeds without adapter calls, harvest later reverts due to invalid config.
**How found:** Code reading: noticed strategy contracts use IAdapter(address(this)) assuming delegatecall context, then observed _verifyAndSetupStrategy uses call, breaking that assumption.
**Insight:** When a contract pattern relies on delegatecall so address(this) is the caller-adapter, audit every entry point that invokes the strategy: any plain call silently changes address(this) and breaks interface assumptions.