News for hackers. Stuff that matters.

A comment on Upgradeable smart contracts in Ethereum. Parent comment

Re:Upgradeable smart contracts in Ethereum by crispyporkbites on Wednesday April 18, 2018 @12:46PM (#16868835)
It achieves the same thing though, you call a contract at address A, which is usually proxies to contract at address B. The owner of A can shift the proxy point to address B or any other address.

The danger here is that the user calling the contract is not aware of the proxy and the new contract does something unexpected.

[ Parent | on HN ]
Re:Upgradeable smart contracts in Ethereum by eudoxus on Wednesday April 18, 2018 @10:53PM (#16873004)
The way I see it, if you are using a contract and you don't know that there is a sole owner that has the ability to upgrade the underlying contract to something else, which could be nefarious, then that is in the same wheel house as using a contract with a bug in it anyways.

It should be standard practice to have some governance model around the upgradeability (IE Multisig, Liquid Democracy, Aragon, etc...). Any contract that doesn't use some governance should be considered insecure and not used for financial transactions on the chain.

[ Parent | on HN ]