# CM can delegatecall to any address and bypass all restrictions

GuardCM only blocked delegatecall to the timelock, so the Community Multisig could delegatecall any contract to zero out its own guard storage and bypass all restrictions.

- Payout: Contest reward
- Severity: high
- Program: Olas
- Credited: EV\_om
- Disclosed: 2024-02-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-autonolas-findings/issues/437
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-02
- Tags: domain:web3 impact:privesc kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:privilege-escalation

**Target:** GnosisSafe transaction guard (GuardCM) on Community Multisig
**Root cause:** The DelegateCall operation check was nested only inside the `to == owner` (timelock) branch, so delegatecalls to any other address were permitted and could overwrite the guard storage slot in the Safe's context.
**Steps:**
1. Set the guard on the CM via `setGuard(guard.address)`.
2. Confirm an unauthorized `timelock.schedule(...)` call reverts under the guard.
3. Deploy `DelegatecallExploitContract` with `deleteGuardStorage()` doing `sstore(GUARD_STORAGE_SLOT, 0)` at slot `0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8`.
4. CM executes a delegatecall (operation=1) to `deleteGuardStorage()`, clearing the guard slot.
5. Re-run the previously blocked `timelock.schedule(...)` call; it now succeeds.
**How found:** Code reading of checkTransaction: noticed the DelegateCall revert was scoped only to the `to == owner` branch, leaving delegatecalls to other addresses unchecked, then reasoned that a delegatecall could overwrite the guard storage slot.
**Exploitation:** A threshold of CM signers submits a Safe transaction with operation=DelegateCall targeting an attacker contract; the contract's code runs in the Safe's storage context and zeroes the guard slot, after which the CM can schedule arbitrary timelock operations and control the protocol.
**Escalation:** CM holds all privileged timelock roles, so removing the guard grants unrestricted control over the entire protocol (privilege escalation).
**Insight:** When a guard restricts operations, verify the restriction is applied globally, not nested inside one target branch; delegatecall lets the callee write the guarded contract's own storage, so any allowed delegatecall can nullify the guard slot itself.