Skip to content
critical Upgradeability No SWC entry CWE-284

UUPS Upgrade Authorization Bug

SAFE-0035 Upgradeability Checked automatically by the scanner
1

What goes wrong

A UUPS contract fails to restrict _authorizeUpgrade, letting anyone upgrade the implementation to malicious code, or leaves the implementation initializable and self-destructible.

2

How to fix it

the pattern that is safe
function _authorizeUpgrade(address) internal override onlyOwner {}
◆
OZ UUPS guidance; always gate _authorizeUpgrade.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$1.43B · 2025 Bybit Access control · 2025 $624M · 2022 Ronin Network Access control · 2022 $611M · 2021 Poly Network Access control · 2021 $291M · 2026 KelpDAO rsETH Access control · 2026
4

Related vulnerabilities in Upgradeability

SAFE-0033Storage Collision in Proxy / Delegatecall critical · Upgradeability SAFE-0034Upgradeable Storage Layout Corruption critical · Upgradeability SAFE-0036Proxy Admin Takeover critical · Upgradeability SAFE-0233UUPS _authorizeUpgrade Unprotected critical · Upgradeability SAFE-0129State Initialised in Constructor of Upgradeable Contract high · Upgradeability SAFE-0230Proxy / Implementation Storage Layout Collision high · Upgradeability SAFE-0234immutable Variable Reads Zero Through Proxy high · Upgradeability SAFE-0128Upgradeable Base Missing Storage Gap medium · Upgradeability
← PreviousUpgradeable Storage Layout Corruption
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0035 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs