Skip to content

immutable Variable Reads Zero Through Proxy

SAFE-0234 Upgradeability Checked automatically by the scanner
1

What goes wrong

An upgradeable contract uses immutable variables, which are baked into the implementation's bytecode at construction and are NOT part of the proxy's storage. Through the proxy they read as their constructor value only if set in the implementation — configuration meant per-proxy is wrong or zero.

2

The vulnerable pattern

proof of concept — how it is exploited
// address immutable ASSET; set in implementation constructor.
// two proxies share one implementation -> both see the same ASSET,
// or a proxy whose impl was deployed with ASSET=0 reads 0.
3

How to fix it

the pattern that is safe
// use regular storage set in initialize(), not immutable, for proxy config
address public asset;
function initialize(address a) external initializer { asset = a; }
Avoid immutable for per-proxy config in upgradeable contracts.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0234 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs