1import{j as e,aM as b,aQ as p,m as a,L as l,ay as o,l as r,az as g,aA as u,aD as y,aE as f,aF as i,aG as n,ah as d,x,S as c,aw as v,Z as j,P as w,B as m}from"./index-DJZuVyTC.js";import{H as N}from"./HubLinksStrip-CYWUGvHy.js";import{T as A}from"./triangle-alert-CEWMGGTe.js";import{E as k}from"./eye-4sB3_9V3.js";const s={initial:{opacity:0,y:20},animate:{opacity:1,y:0}},z={"@context":"https://schema.org","@graph":[{"@type":"Article",headline:"DELEGATECALL Vulnerabilities in Smart Contracts: Risks & Prevention",description:"How delegatecall executes external code inside your contract's storage context â and why a bug in a library you call becomes a bug in your contract.",author:{"@type":"Organization",name:"SmartContractAuditor.ai"},publisher:{"@type":"Organization",name:"SmartContractAuditor.ai"},datePublished:"2026-05-17",dateModified:"2026-05-17"},{"@type":"FAQPage",mainEntity:[{"@type":"Question",name:"What makes delegatecall dangerous?",acceptedAnswer:{"@type":"Answer",text:"Unlike a regular call, delegatecall runs the target contract's code using the caller's storage, msg.sender, and msg.value. This means a bug or backdoor in the called contract can directly corrupt your contract's storage â including overwriting owner variables and draining funds."}},{"@type":"Question",name:"How did delegatecall cause the Parity wallet hack?",acceptedAnswer:{"@type":"Answer",text:"Parity multi-sig wallets delegatecalled into a shared library contract. An attacker called the library's initialize() function directly (no access control), made themselves the owner, then called the self-destruct function. All wallets delegatecalling that library lost access to their funds permanently."}},{"@type":"Question",name:"When is delegatecall safe to use?",acceptedAnswer:{"@type":"Answer",text:"delegatecall is safe when you call a known, audited contract at a hardcoded address (not a user-supplied address), the called contract cannot self-destruct, and the storage layout of both contracts is carefully aligned. OpenZeppelin's proxy patterns are the standard way to do this correctly."}}]}]};function C(){return e.jsxs(e.Fragment,{children:[e.jsx(b,{title:"DELEGATECALL Vulnerabilities in Smart Contracts: Risks & Prevention",description:"delegatecall runs external code inside your storage context. A bug in the library you call becomes a bug in your contract. Learn how Parity lost $30M and how to protect your contracts.",keywords:"delegatecall vulnerability, delegatecall exploit solidity, proxy delegatecall risk, parity wallet hack, delegatecall storage collision, ethereum delegatecall security",structuredData:z}),e.jsxs("div",{className:"min-h-screen bg-[#080a12] text-white",children:[e.jsxs("div",{className:"fixed inset-0 overflow-hidden pointer-events-none",children:[e.jsx("div",{className:"absolute top-1/4 left-1/4 w-96 h-96 bg-emerald-500/5 rounded-full blur-3xl"}),e.jsx("div",{className:"absolute bottom-1/4 right-1/4 w-96 h-96 bg-blue-500/5 rounded-full blur-3xl"})]}),e.jsx(p,{}),e.jsxs("main",{className:"relative max-w-5xl mx-auto px-4 sm:px-6 lg:px-8 py-12",children:[e.jsxs(a.nav,{initial:"initial",animate:"animate",variants:s,className:"flex items-center gap-2 text-sm text-slate-500 mb-8",children:[e.jsx(l,{href:"/",children:e.jsx("span",{className:"hover:text-slate-300 transition-colors cursor-pointer",children:"Home"})}),e.jsx(o,{className:"w-4 h-4"}),e.jsx("span",{className:"text-slate-400",children:"Vulnerabilities"}),e.jsx(o,{className:"w-4 h-4"}),e.jsx("span",{className:"text-white",children:"DELEGATECALL"})]}),e.jsxs(a.div,{initial:"initial",animate:"animate",variants:s,transition:{delay:.1},className:"mb-12",children:[e.jsxs("div",{className:"flex items-center gap-3 mb-4",children:[e.jsx(r,{className:"bg-red-500/20 text-red-300 border border-red-500/40 px-3 py-1",children:"Critical Severity"}),e.jsx(r,{className:"bg-slate-800 text-slate-400 border border-slate-700 px-3 py-1",children:"Proxy & Storage"})]}),e.jsx("h1",{className:"text-4xl sm:text-5xl font-bold text-white mb-6 leading-tight",children:"DELEGATECALL Vulnerabilities"}),e.jsxs("p",{className:"text-xl text-slate-400 leading-relaxed mb-6 max-w-3xl",children:[e.jsx("code",{className:"text-emerald-300 bg-slate-900 px-1 rounded",children:"delegatecall"})," is one of the most powerful â and most dangerous â opcodes in Solidity. It runs external
1code inside your contract's own storage context. A bug in any library you delegate to is effectively a bug in your contract."]}),e.jsxs(g,{className:"border-red-500/30 bg-red-500/10 max-w-2xl",children:[e.jsx(A,{className:"w-4 h-4 text-red-400"}),e.jsxs(u,{className:"text-red-200 text-sm",children:[e.jsx("strong",{children:"Parity Multi-Sig Wallet (2017)"})," â $30M in ETH was permanently frozen when an attacker initialized an unguarded library contract via delegatecall, became its owner, then called self-destruct. Every wallet that relied on that library lost access to its funds forever."]})]})]}),e.jsx(a.div,{initial:"initial",animate:"animate",variants:s,transition:{delay:.2},className:"mb-16",children:e.jsxs(y,{defaultValue:"overview",children:[e.jsxs(f,{className:"bg-slate-900/80 border border-white/10 mb-8 flex-wrap h-auto gap-1 p-1",children:[e.jsx(i,{value:"overview",className:"data-[state=active]:bg-slate-700",children:"Overview"}),e.jsx(i,{value:"code",className:"data-[state=active]:bg-slate-700",children:"Code Examples"}),e.jsx(i,{value:"prevention",className:"data-[state=active]:bg-slate-700",children:"Prevention"}),e.jsx(i,{value:"detection",className:"data-[state=active]:bg-slate-700",children:"Detection"})]}),e.jsxs(n,{value:"overview",className:"space-y-8",children:[e.jsxs("div",{className:"bg-slate-900/50 border border-slate-800/80 rounded-2xl p-6",children:[e.jsx("h2",{className:"text-xl font-bold text-white mb-4",children:"How delegatecall works"}),e.jsxs("div",{className:"space-y-4",children:[e.jsxs("p",{className:"text-slate-400 leading-relaxed",children:["Normally, when contract A calls contract B, B's code runs using B's own storage, B's address, and the caller's msg.sender. With ",e.jsx("code",{className:"text-emerald-300",children:"delegatecall"}),", B's code runs but everything else belongs to A: A's storage, A's address, A's ETH balance."]}),e.jsxs("p",{className:"text-slate-400 leading-relaxed",children:["This is intentional and useful â it's how proxy contracts work. But it creates a fundamental risk: ",e.jsx("strong",{className:"text-white",children:`anything B's code does to "its own" variables actually modifies A's storage slots.`})," If an attacker can influence what B does, they control A."]}),e.jsx("div",{className:"grid md:grid-cols-2 gap-4 mt-4",children:[{title:"User-controlled delegate target",desc:"The address passed to delegatecall comes from user input. Attacker supplies their own malicious contract.",severity:"Critical",color:"text-red-400 bg-red-500/10 border-red-500/30"},{title:"Unprotected initializer",desc:"Library or implementation contract has no access control on initialize(). Anyone can call it and become owner.",severity:"Critical",color:"text-red-400 bg-red-500/10 border-red-500/30"},{title:"Storage layout mismatch",desc:"Proxy and implementation define storage variables in different orders. Write to slot 0 in impl overwrites slot 0 (owner) in proxy.",severity:"High",color:"text-orange-400 bg-orange-500/10 border-orange-500/30"},{title:"Self-destruct in delegate target",desc:"Implementation contract contains selfdestruct. If called, it kills the proxy (not the impl), since delegatecall runs in proxy's context.",severity:"Critical",color:"text-red-400 bg-red-500/10 border-red-500/30"}].map(t=>e.jsxs("div",{className:"p-4 bg-slate-900/50 rounded-lg border border-white/5",children:[e.jsx(r,{className:`text-xs border ${t.color} mb-2`,children:t.severity}),e.jsx("h3",{className:"font-semibold text-white mb-1 text-sm",children:t.title}),e.jsx("p",{className:"text-slate-400 text-sm",children:t.desc})]},t.title))})]})]}),e.jsxs("div",{className:"bg-slate-900/50 border border-slate-800/80 rounded-2xl p-6",children:[e.jsx("h2",{className:"text-xl font-bold text-white mb-4",children:"Real-world exploits"}),e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-white/10",children:[e.jsx("th",{className:"text-left text-slate-400 font-medium py-2 pr-4",children:"Protocol"}),e.jsx("th",{className:"text-left text-slate-400 font-medium py-2 pr-4",children:"Year"}),e.jsx("th",{className:"text-left text-slate-400 font-medium py-2 pr-4",children:"Pattern"}),e.jsx("th",{className:"text-left text-slate-400 font-medium py-2",children:"Loss"})]})}),e.jsx("tbody",{className:"divide-y divide-white/5",children:[{name:"Parity Multi-Sig",year:"2017",pattern:"Unprotected initializer in shared library",loss:"$30M frozen forever"},{name:"Parity Multi-Sig v1",year:"2017",pattern:"User-controlled delegatecall target",loss:"$3
11M drained"},{name:"Wormhole Bridge",year:"2022",pattern:"Delegatecall in guardian verification logic",loss:"$320M"},{name:"Ronin Bridge",year:"2022",pattern:"Proxy upgrade without sufficient multisig",loss:"$625M"}].map(t=>e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-4 text-white font-medium",children:t.name}),e.jsx("td",{className:"py-3 pr-4 text-slate-400",children:t.year}),e.jsx("td",{className:"py-3 pr-4 text-slate-400",children:t.pattern}),e.jsx("td",{className:"py-3 text-red-400",children:t.loss})]},t.name))})]})})]})]}),e.jsxs(n,{value:"code",className:"space-y-8",children:[e.jsxs("div",{className:"bg-white/5 border border-red-500/20 rounded-xl p-6",children:[e.jsxs("div",{className:"flex items-center gap-2 mb-4",children:[e.jsx(d,{className:"w-5 h-5 text-red-400"}),e.jsx("h2",{className:"text-xl font-bold text-red-300",children:"Vulnerable: user-controlled delegatecall"})]}),e.jsx("pre",{className:"bg-slate-950 rounded-lg p-4 text-sm text-slate-300 overflow-x-auto",children:`// VULNERABLE â attacker supplies their own malicious contract address 2contract Vulnerable { 3 address public owner; 4 5 // Any caller can pass any _target they want 6 function execute(address _target, bytes memory _data) external { 7 // delegatecall runs _target's code in THIS contract's storage 8 // Attacker's contract can set owner = attacker 9 (bool ok,) = _target.delegatecall(_data); 10 require(ok, "failed"); 11 } 12}`})]}),e.jsxs("div",{className:"bg-white/5 border border-red-500/20 rounded-xl p-6",children:[e.jsxs("div",{className:"flex items-center gap-2 mb-4",children:[e.jsx(d,{className:"w-5 h-5 text-red-400"}),e.jsx("h2",{className:"text-xl font-bold text-red-300",children:"Vulnerable: unprotected initializer (Parity pattern)"})]}),e.jsx("pre",{className:"bg-slate-950 rounded-lg p-4 text-sm text-slate-300 overflow-x-auto",children:`// VULNERABLE library â no access control on initWallet() 13// Deployed standalone (not behind a proxy), callable by anyone 14contract WalletLibrary { 15 address public owner; 16 17 // Anyone can call this directly on the library contract 18 function initWallet(address _owner) public { 19 owner = _owner; // sets THIS contract's owner 20 } 21 22 function kill() external { 23 require(msg.sender == owner); 24 selfdestruct(payable(owner)); // destroys the library 25 // Every proxy delegatecalling this library now has no code to run 26 } 27}`})]}),e.jsxs("div",{className:"bg-white/5 border border-emerald-500/20 rounded-xl p-6",children:[e.jsxs("div",{className:"flex items-center gap-2 mb-4",children:[e.jsx(x,{className:"w-5 h-5 text-emerald-400"}),e.jsx("h2",{className:"text-xl font-bold text-emerald-300",children:"Safe: hardcoded target + protected initializer"})]}),e.jsx("pre",{className:"bg-slate-950 rounded-lg p-4 text-sm text-slate-300 overflow-x-auto",children:`import "@openzeppelin/contracts/proxy/utils/Initializable.sol"; 28 29// SAFE implementation contract â uses Initializable to prevent re-initialization 30contract SafeImplementation is Initializable { 31 address public owner; 32 33 // initializer modifier from OpenZeppelin ensures this runs only once 34 function initialize(address _owner) external initializer { 35 owner = _owner; 36 } 37 38 // No selfdestruct â ever 39} 40 41// SAFE proxy â target is hardcoded, not user-supplied 42contract SafeProxy { 43 // EIP-1967 storage slot for implementation address 44 // Avoids collision with implementation's storage layout 45 bytes32 private constant IMPL_SLOT = 46 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc; 47 48 constructor(address _impl, bytes memory _initData) { 49 assembly { sstore(IMPL_SLOT, _impl) } 50 (bool ok,) = _impl.delegatecall(_initData); 51 require(ok); 52 } 53 54 fallback() external payable { 55 assembly { 56 let impl := sload(IMPL_SLOT) 57 calldatacopy(0, 0, calldatasize()) 58 let result := delegatecall(gas(), impl, 0, calldatasize(), 0, 0) 59 returndatacopy(0, 0, returndatasize()) 60 switch result 61 case 0 { revert(0, returndatasize()) } 62 default { return(0, returndatasize()) } 63 } 64 } 65}`}),e.jsxs("p",{className:"text-sm text-slate-400 mt-3",children:["OpenZeppelin's ",e.jsx("code",{className:"text-emerald-400",children:"TransparentUpgradeableProxy"})," and"," ",e.jsx("code",{className:"text-emerald-400",children:"UUPSUpgradeable"})," implement this pattern correctly."]})]})]}),e.jsxs(n,{value:"prevention",className:"space-y-8",children:[e.jsxs("div",{className:"bg-slate-900/50 border border-slate-800/80 rounded-2xl p-6",children:[e.jsx("h2",{className:"text-xl font-bold text-white mb-6",children:"Safe vs. dangerous patterns"}),e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-white/10",children:[e.jsx("th",{className:"text-left text-red-400 font-medium py-2 pr-6",children:"Avoid"}),e.jsx("th",{className:"text-left text-emerald-400 font-medium py-2",children:"Use instead"})]})}),e.jsx("tbody",{className:"divide-y divide-white/5",children:[{bad:"delegatecall to a user-supplied address",good:"delegatecall only to a hardcoded, audited address"},{bad:"initialize() with no access control on impl contract",good:"Use OpenZeppelin's Initializable with the initializer modifier"},{bad:"selfdestruct inside any contract delegatecall'd by a proxy",good:"Never include selfdestruct in implementation contracts"},{bad:"Different storage variable order between proxy and impl",good:"Use EIP-1967 storage slots; inherit storage from a base contract"},{bad:"Upgrading proxy without multisig or timelock",good:"Require N-of-M multisig approval for any upgrade; add timelock delay"}].map((t,h)=>e.jsxs("tr",{children:[e.jsx("td",{className:"py-3 pr-6",children:e.jsxs("div",{className:"flex items-start gap-2",children:[e.jsx(d,{className:"w-4 h-4 text-red-400 mt-0.5 flex-shrink-0"}),e.jsx("span",{className:"text-red-300",children:t.bad})]})}),e.jsx("td",{className:"py-3",children:e.jsxs("div",{className:"flex items-start gap-2",children:[e.jsx(x,{className:"w-4 h-4 text-emerald-400 mt-0.5 flex-shrink-0"}),e.jsx("span",{className:"text-emerald-300",children:t.good})]})})]},h))})]})})]}),e.jsx("div",{className:"grid md:grid-cols-2 gap-6",children:[{title:"Use OpenZeppelin proxy contracts",description:"TransparentUpgradeableProxy, UUPSUpgradeable, and BeaconProxy handle storage slots, initializer
65s, and upgrade access control correctly. Don't roll your own.",icon:c,color:"text-emerald-400",bg:"bg-emerald-500/10",border:"border-emerald-500/20"},{title:"Lock implementation contracts",description:"Call _disableInitializers() in the implementation contract's constructor so it can never be initialized directly â only through the proxy.",icon:v,color:"text-blue-400",bg:"bg-blue-500/10",border:"border-blue-500/20"},{title:"Align storage layouts",description:"Use hardhat-storage-layout or foundry's storage inspection to verify that the proxy and implementation use identical slot positions for every shared variable.",icon:k,color:"text-emerald-400",bg:"bg-emerald-500/10",border:"border-emerald-500/20"},{title:"Never delegatecall user input",description:"If your contract takes an address and calls it with delegatecall, an attacker will find it. There is no safe way to delegatecall a user-supplied address.",icon:j,color:"text-red-400",bg:"bg-red-500/10",border:"border-red-500/20"}].map(t=>e.jsxs("div",{className:`bg-white/5 border ${t.border} rounded-xl p-5`,children:[e.jsx("div",{className:`inline-flex p-2 ${t.bg} rounded-lg mb-3`,children:e.jsx(t.icon,{className:`w-5 h-5 ${t.color}`})}),e.jsx("h3",{className:"font-semibold text-white mb-2",children:t.title}),e.jsx("p",{className:"text-slate-400 text-sm leading-relaxed",children:t.description})]},t.title))})]}),e.jsxs(n,{value:"detection",className:"space-y-8",children:[e.jsxs("div",{className:"bg-slate-900/50 border border-slate-800/80 rounded-2xl p-6",children:[e.jsx("h2",{className:"text-xl font-bold text-white mb-4",children:"What the scanner flags"}),e.jsx("div",{className:"space-y-3",children:[{pattern:"delegatecall to a non-constant or user-supplied address",severity:"Critical",color:"text-red-400 bg-red-500/10 border-red-500/30"},{pattern:"initialize() function without Initializable or access control modifier",severity:"Critical",color:"text-red-400 bg-red-500/10 border-red-500/30"},{pattern:"selfdestruct in any contract used as a delegatecall target",severity:"Critical",color:"text-red-400 bg-red-500/10 border-red-500/30"},{pattern:"Proxy and implementation sharing storage slot 0 for different variables",severity:"High",color:"text-orange-400 bg-orange-500/10 border-orange-500/30"},{pattern:"upgradeTo() or upgradeToAndCall() without onlyOwner or role check",severity:"High",color:"text-orange-400 bg-orange-500/10 border-orange-500/30"},{pattern:"Implementation contract deployed without _disableInitializers() in constructor",severity:"Medium",color:"text-amber-400 bg-amber-500/10 border-amber-500/30"}].map(t=>e.jsxs("div",{className:"flex items-center justify-between p-3 bg-slate-900/50 rounded-lg border border-white/5",children:[e.jsxs("div",{className:"flex items-center gap-3",children:[e.jsx(w,{className:"w-4 h-4 text-slate-500 flex-shrink-0"}),e.jsx("span",{className:"text-slate-300 text-sm",children:t.pattern})]}),e.jsx(r,{className:`text-xs border ${t.color} ml-4 flex-shrink-0`,children:t.severity})]},t.pattern))})]}),e.jsxs("div",{className:"bg-slate-900/50 border border-slate-800/80 rounded-2xl p-6",children:[e.jsx("h2",{className:"text-xl font-bold text-white mb-4",children:"Manual review checklist"}),e.jsx("div",{className:"space-y-2",children:["Does any function accept an address parameter and call it with delegatecall?","Can the implementation contract's initialize() be called by anyone directly?","Does the implementation contain any selfdestruct call?","Are the storage variable orders identical between proxy and implementation?","Is the upgrade function protected by multisig and/or timelock?","Is _disableInitializers() called in the implementation's constructor?","Are all EIP-1967 storage slots used correctly (not overlapping with variable declarations)?"].map(t=>e.jsxs("div",{className:"flex items-start gap-3 p-3 rounded-lg hover:bg-white/5 transition-colors",children:[e.jsx("div",{className:"w-5 h-5 border border-slate-600 rounded flex-shrink-0 mt-0.5"}),e.jsx("span",{className:"text-slate-400 text-sm",children:t})]},t))})]})]})]})}),e.jsxs(a.div,{initial:"initial",animate:"animate",variants:s,transition:{delay:.3},className:"mb-16",children:[e.jsx("h2",{className:"text-2xl font-bold text-white mb-6",children:"Related vulnerabilities"}),e.jsx("div",{className:"grid md:grid-cols-3 gap-4",children:[{title:"Proxy Upgrade Vulnerabilities",description:"Upgradeable proxy patterns introduce additional risks around storage collision and unprotected upgrade functions.",href:"/vulnerabilities/proxy-vulnerabilities",color:"border-emerald-500/30 hover:border-purple-400/50",badge:"High Severity",badgeColor:"bg-emerald-500/10 text-emerald-300 border-emerald-500/30"},{title:"Access Control Flaws",description:"Missing or bypassable access controls are what allow attackers to trigger delegatecall and initializer exploits.",href:"/vulnerabilities/access-control-flaws",color:"border-red-500/30 hover:border-red-400/50",badge:"High Severity",badgeColor:"bg-red-500/10 text-red-300 border-red-500/30"}
65,{title:"Reentrancy Attacks",description:"Delegatecall can introduce reentrancy if the called contract makes external calls before updating state.",href:"/vulnerabilities/reentrancy-attacks",color:"border-orange-500/30 hover:border-orange-400/50",badge:"High Severity",badgeColor:"bg-orange-500/10 text-orange-300 border-orange-500/30"}].map(t=>e.jsx(l,{href:t.href,children:e.jsxs("div",{className:`bg-white/5 border ${t.color} rounded-xl p-5 cursor-pointer transition-all duration-200 hover:bg-white/8`,children:[e.jsx(r,{className:`text-xs border ${t.badgeColor} mb-3`,children:t.badge}),e.jsx("h3",{className:"font-semibold text-white mb-2",children:t.title}),e.jsx("p",{className:"text-slate-400 text-sm leading-relaxed",children:t.description}),e.jsxs("div",{className:"flex items-center gap-1 mt-3 text-slate-500 text-xs",children:[e.jsx("span",{children:"Learn more"}),e.jsx(o,{className:"w-3 h-3"})]})]})},t.title))})]}),e.jsx(N,{}),e.jsxs(a.div,{initial:"initial",animate:"animate",variants:s,transition:{delay:.4},className:"relative overflow-hidden rounded-2xl bg-gradient-to-br from-emerald-900/40 via-blue-900/30 to-slate-900/60 border border-emerald-500/30 p-8 text-center",children:[e.jsx("div",{className:"absolute inset-0 bg-gradient-to-br from-emerald-500/5 to-blue-500/5"}),e.jsxs("div",{className:"relative",children:[e.jsx(c,{className:"w-10 h-10 text-emerald-400 mx-auto mb-4"}),e.jsx("h2",{className:"text-2xl font-bold text-white mb-3",children:"Scan for delegatecall vulnerabilities"}),e.jsx("p",{className:"text-slate-400 mb-6 max-w-lg mx-auto",children:"Our scanner checks for user-controlled delegatecall targets, unprotected initializers, storage layout mismatches, and other proxy-related risks."}),e.jsxs("div",{className:"flex flex-col sm:flex-row gap-3 justify-center",children:[e.jsx(l,{href:"/dashboard",children:e.jsxs(m,{size:"lg",className:"bg-gradient-to-r from-emerald-500 to-cyan-500 hover:from-emerald-600 hover:to-blue-600 text-white font-semibold px-8 shadow-xl",children:[e.jsx(c,{className:"w-5 h-5 mr-2"}),"Scan for DELEGATECALL Issues"]})}),e.jsx(l,{href:"/vulnerabilities/proxy-vulnerabilities",children:e.jsx(m,{size:"lg",variant:"outline",className:"border-white/20 text-slate-300 hover:bg-white/5",children:"View Proxy Vulnerabilities"})})]})]})]})]})]})]})}export{C as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.