feat: Add delegate call and proxy pattern vulnerability detection (CP-118)

[Nanle-code]

Overview

Proxy and upgrade patterns are ubiquitous in modern DeFi — UUPS, Transparent Proxy, Beacon Proxy, and Diamond (EIP-2535) are all in production. Each introduces a unique class of vulnerabilities around delegatecall, storage layout collisions, and unprotected upgrade functions. ChainProof currently has no coverage for these patterns.

Vulnerability Patterns to Detect

1. Storage Slot Collision in Proxy Contracts

// Proxy.sol
contract Proxy {
    address public implementation; // slot 0

// Implementation.sol
contract Implementation {
    address public owner; // also slot 0 — COLLISION
}

When the proxy delegatecalls into the implementation, writes to owner overwrite implementation.

2. Unprotected upgradeTo / _authorizeUpgrade

function _authorizeUpgrade(address newImpl) internal override {} // empty body

Any address can upgrade the contract to arbitrary logic.

3. Uninitialized Implementation Contract

The implementation contract of a proxy can be self-destructed if its initialize() function is callable by anyone and sets ownership to the caller — a known attack vector (Parity hack).

4. delegatecall to User-Controlled Address

function execute(address target, bytes calldata data) external {
    target.delegatecall(data); // attacker can supply a malicious target
}

5. Function Selector Clashing (Diamond Proxy)

Two facets registering the same 4-byte function selector, causing one to shadow the other.

Proposed Rule: CP-118

Detection approach:

1. Identify proxy patterns via storage variable naming heuristic (_implementation, implementation, _IMPLEMENTATION_SLOT)
2. Detect delegatecall to non-constant address (parameter or state variable that can change)
3. Check _authorizeUpgrade and upgradeTo functions for access control guards
4. Detect storage layout conflicts by enumerating slot 0 in proxy vs implementation
5. Flag uninitialized implementation contracts (initialize callable without state guard)

Acceptance Criteria

• CP-118 rule in packages/core/src/rules/cp118-proxy-delegate.ts
• All 5 patterns above detected with Critical/High severity
• Proxy pattern auto-detection heuristic (naming + inheritance)
• Storage slot collision detection for same-slot variable declarations
• Example vulnerable UUPS proxy in examples/contracts/proxy/
• Example secure UUPS proxy with OpenZeppelin pattern in same folder

References

• EIP-1967 — Standard Proxy Storage Slots
• EIP-2535 — Diamond Proxy
• Parity Wallet Hack