Solidity

Diamond Proxy

A diamond proxy is an EIP-2535 upgradeable proxy pattern that routes function selectors to multiple facet contracts.

One proxy address can expose functions from many implementation contracts called facets.

Diamond Proxy Explained in Detail

A diamond proxy routes calls by function selector to facet contracts. Each facet contains part of the system's logic, while the diamond proxy keeps the stable address and usually stores shared state.

The pattern is standardized by EIP-2535 and is often used for modular systems with many functions or frequent upgrades.

Smart contract example

The critical upgrade operation is commonly called diamondCut. It can add, replace, or remove selector-to-facet mappings.

If an attacker can call diamondCut, they can replace privileged selectors, remove safety checks, or redirect user-facing functions to malicious facets.

Diamond Proxy in Auditing

Diamonds expand the normal upgradeable proxy attack surface. Auditors must review selector routing, facet permissions, shared storage, initialization, and upgrade governance across the whole diamond, not one implementation contract at a time.

Facet separation does not imply storage separation. Many facets operate on the same proxy storage through delegatecall.

Red flags in code

  • diamondCut is weakly protected or callable through an unexpected path.

  • Facets use inconsistent access control for related privileged functions.

  • Selector collisions or replacement behavior are not documented.

  • Shared storage layouts use unclear namespaces or overlapping slots.

  • Removed selectors leave stale assumptions in other facets.

How to test or review it

  • Map every function selector to its current facet.

  • Test diamondCut as owner, governance, non-owner, and malicious facet callers.

  • Review function selector collisions and replacement rules.

  • Compare storage namespaces used by all facets.

  • Verify loupe functions or inspection tooling match deployed selector mappings.

Upgradeable Proxy

An upgradeable proxy is a smart contract pattern where users call a stable proxy address while execution is delegated to replaceable implementation logic.

Function Selector

A function selector is the first 4 bytes of calldata that tells an EVM contract which function should handle a call.

Storage Collision

A storage collision happens when two variables or contracts use the same storage slot, corrupting state in upgradeable or delegatecall-based systems.

Access Control Attacks

Access control attacks in Solidity: broken authorization patterns, privilege escalation paths, and secure role and ownership design.

Delegatecall & Call Injection Attacks

Delegatecall and call injection attacks in Solidity: storage collision exploits, proxy vulnerabilities like Parity, and secure upgrade patterns.

Smart Contract Audit Checklist

Use this SCH tool to turn the concept into practical audit work.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Diamond Proxy into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources