Writeup for the Preservation level of the Ethernaut: hijacking the contract via a delegatecall storage-slot collision.
Writeup for the Delegation level of the Ethernaut: hijacking ownership through a delegatecall in the contract's fallback function.