An upgrade path can bypass otherwise correct application permissions.
LET’S PICTURE IT
A locked service desk is irrelevant if anyone can replace the entire office manual.
SEE IT FOR YOURSELF
Pack small values into Solidity storage slotsStep 1 / 4
In this simple default-layout example, two uint128 values come before one uint256. Each slot holds thirty-two bytes.
In this simple default-layout example, two uint128 values come before one uint256. Each slot holds thirty-two bytes.The first sixteen-byte value occupies the low-order half of slot zero. Low-order bytes are shown on the right.The second uint128 fits in the remaining sixteen bytes. Both values now share slot zero.C needs a complete thirty-two-byte slot, so it begins at slot one. Two packed small values plus C use two slots.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Locate the final target write
Trace every route that can change the implementation or execution target. The security question is who can cause that effect, not just which function has an admin-like name.
Check the current context
An authorization check must run in the intended proxy or implementation context. Confusing direct and delegated execution can produce incorrect authority assumptions.
Preserve policy through upgrades
A new implementation can change the future upgrade gate. Review the resulting authority model, not only the current upgrade transaction’s permission.
Test adversarial transitions
Try unauthorized upgrades, role changes and incompatible targets locally. Assert that rejected attempts preserve both target and application state.