An upgradeable contract uses immutable variables, which are baked into the implementation's bytecode at construction and are NOT part of the proxy's storage. Through the proxy they read as their constructor value only if set in the implementation — configuration meant per-proxy is wrong or zero.
// address immutable ASSET; set in implementation constructor. // two proxies share one implementation -> both see the same ASSET, // or a proxy whose impl was deployed with ASSET=0 reads 0.
// use regular storage set in initialize(), not immutable, for proxy config
address public asset;
function initialize(address a) external initializer { asset = a; }
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0234 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.