# Arbitrary external call as contract

Caller-controlled target and calldata run as the contract, abusing its approvals, roles or identity

_Area: Smart contract access control and control flow. Seen in 43 disclosed reports; one confirmed bounty: $1,500; latest 2026-09-21. Updated 2026-10-23._

## How it works
A contract executes `target.call(data)` where target and calldata come from the caller. The call runs with the contract's own address, so it inherits what that address holds: token approvals, credit delegations, privileged roles, owned NFTs, and its identity as `msg.sender` to other protocols. The broken assumption is that the caller cannot make the contract act as itself. Guards that only check the first calldata word, whitelist the target, or check a post-call balance delta do not constrain which function runs or on whose behalf. Evidence covers `call` only; `delegatecall` shares the shape but is not shown here.

## Where it shows up
- `approveAndCall`/ERC677-style helpers whose only guard is first-calldata-word-equals-caller [E1](https://bugbountylibrary.com/r/dhl%3A20260822-sandboxoft.md)
- Public `rubicall`/`execute`/`multicall` helpers forwarding arbitrary selector and args [E4](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-09.md)[E6](https://bugbountylibrary.com/r/dhl%3A20260921-gaslessreservoirenabler.md)
- Permissionless entrypoints forwarding user `initCalldata`/`modifyCalldata` into a privileged target [E3](https://bugbountylibrary.com/r/dhl%3A20260806-unistreetlaunchpad.md)
- Caller-supplied token addresses used to satisfy validation checks [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-2.md)
- Contracts holding standing approvals, credit delegations, or custodied NFTs while exposing a generic call [E7](https://bugbountylibrary.com/r/dhl%3A20260419-aaverebalancercreditdelegation.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-01.md)
- Whitelists that include live tokens or high-value contracts as "modules" [E6](https://bugbountylibrary.com/r/dhl%3A20260921-gaslessreservoirenabler.md)

## How to review
Find every path where caller-influenced target or calldata reaches `call`. For each, enumerate the reachable selectors (diff the target ABI against a fixed, reviewed allowlist); none may move value or change roles on the contract's behalf. List what the contract's address controls: approvals, roles, owned assets, delegate/DVN status, credit lines. Reject guards based only on first-calldata-word equality, target whitelisting, or a balance delta an attacker-controlled token or callback can satisfy [E1](https://bugbountylibrary.com/r/dhl%3A20260822-sandboxoft.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-2.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-01.md). Check whether the contract is `msg.sender` downstream, making its entrypoint an identity-confusion primitive [E4](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-09.md).

## Variants seen
- Token helper hijacking a bridge delegate role to mint unbacked tokens [E1](https://bugbountylibrary.com/r/dhl%3A20260822-sandboxoft.md)
- Malicious `tokenIn` plus malicious target satisfying a balance-delta check [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-2.md)
- Forwarded calldata into `multicall` executed as the LP-NFT owner [E3](https://bugbountylibrary.com/r/dhl%3A20260806-unistreetlaunchpad.md)
- Shared helper acting as `msg.sender` to cancel and redirect a victim's refund [E4](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-09.md)
- Whitelisted token invoked via `transferFrom` on standing approvals [E6](https://bugbountylibrary.com/r/dhl%3A20260921-gaslessreservoirenabler.md)
- Arbitrary call abusing a credit delegation to borrow [E7](https://bugbountylibrary.com/r/dhl%3A20260419-aaverebalancercreditdelegation.md)
- Approve-then-arbitrary-call letting a callback move custodied NFTs [E8](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-01.md)

## Why fixes fail
Guards that check only the first calldata word [E1](https://bugbountylibrary.com/r/dhl%3A20260822-sandboxoft.md) or a post-call balance delta [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-2.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-01.md) leave the selector and spender attacker-chosen, so the same primitive is re-reachable.

## Impact and severity
Outcomes ranged from draining all contract-held USDT [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-2.md) and 466 victims' approvals [E6](https://bugbountylibrary.com/r/dhl%3A20260921-gaslessreservoirenabler.md) to 7,000 WAVAX borrowed via delegation [E7](https://bugbountylibrary.com/r/dhl%3A20260419-aaverebalancercreditdelegation.md), 10M unbacked tokens [E1](https://bugbountylibrary.com/r/dhl%3A20260822-sandboxoft.md), and ~$17.75K in LP positions [E3](https://bugbountylibrary.com/r/dhl%3A20260806-unistreetlaunchpad.md). Severity rises with what the contract's address controls; standing approvals and privileged roles made small bugs critical.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260822-sandboxoft.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-2.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260806-unistreetlaunchpad.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-09.md
- E5: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sharedstake-insider-exploit-postmortem.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260921-gaslessreservoirenabler.md
- E7: https://bugbountylibrary.com/r/dhl%3A20260419-aaverebalancercreditdelegation.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AH-01.md