Proxy & Upgradeability Vulnerabilities

Why this rank in 2026

New for 2026. Added because 2025 saw uninitialized ERC1967 proxies become an automated attack campaign - attackers scanned for uninitialized implementations, became the owner, and either drained immediately or planted a dormant backdoor for later activation. The category did not exist in OWASP 2025 but is now the most novel attack class on the list.

Vulnerable vs secure code

// Vulnerable: implementation is not locked; anyone can initialize the implementation directly
contract VaultImpl {
    address public owner;
    bool internal initialized;

    function initialize(address _owner) external {
        require(!initialized, "already init");
        initialized = true;
        owner = _owner;
    }
}

// Secure: lock the implementation in its constructor + OpenZeppelin Initializable
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";

contract VaultImpl is Initializable, OwnableUpgradeable, UUPSUpgradeable {
    /// @custom:oz-upgrades-unsafe-allow constructor
    constructor() { _disableInitializers(); }

    function initialize(address admin) public initializer {
        __Ownable_init(admin);
        __UUPSUpgradeable_init();
    }

    function _authorizeUpgrade(address) internal override onlyOwner {}
}

Prevention checklist

• Use established proxy patterns (OpenZeppelin UUPS or Transparent).
• Protect upgrade roles with multisig governance, never a single EOA.
• Apply initializer and reinitializer modifiers correctly on every implementation.
• Call _disableInitializers() in the implementation constructor to lock it.
• Add timelocks and multi-step upgrade processes.
• Maintain upgrade runbooks and migration tests for every release.
• Verify new implementation code AND storage-layout compatibility before any upgrade.
• Simulate upgrade steps on-chain (Tenderly, Foundry) before mainnet execution.

Deep dive: related SCH attack pages

Sources & methodology

Every claim on this page traces back to a primary, citable source. Open the originals if you want to verify the numbers or read the underlying methodology.

Quoted OWASP descriptions are used under CC BY-NC-SA 4.0. SCH editorial content (analysis, code, prevention prose, FAQ, AI-vs-human rates) is © Smart Contract Hacking.