직책 입력

직책

이름

핵심 팀은 국제 사법 협력, 형사 사법 시스템, 자금 세탁 방지 및 부패 측면에서 낮은 종합 등급을 받은 국가에 위치하고 있습니다. 이러한 맥락적 데이터는 사기를 예방하고 완화하는 데 있어 어려움과 복잡성이 증가했음을 시사합니다.

핵심 팀은 국제 사법 협력, 형사 사법 시스템, 자금 세탁 방지 및 부패 측면에서 중간 등급을 받은 국가에 위치하고 있습니다. 이러한 상황별 데이터는 중간 수준의 지리적 책임성을 시사하며, 따라서 사기 위험을 줄이고 완화할 수 있습니다.

핵심 팀은 국제 사법 협력, 형사 사법 시스템, 자금 세탁 방지 및 부패 측면에서 가장 높은 종합 등급을 받은 국가에 위치해 있습니다. 이러한 상황별 데이터는 가장 높은 수준의 지리적 책임을 시사하며, 따라서 위험 감소 및 완화를 극대화합니다.

Upgrading a Web3 project is like trying to change the tires on a racecar while it’s driving at 200 mph. Because blockchains are meant to be "permanent," developers use clever tricks to update code, but these tricks create unique backdoors for hackers.

Attack surfaces introduced by upgrades and migrations

Read and Learn

Since you can't change code once it's on the blockchain, developers use a __Proxy__. Think of the Proxy as a "Phone Operator" and the Logic as the "Department." Users call the Operator, who forwards the call to the Department. An upgrade just tells the Operator to forward calls to a new Department.

The "Proxy" Concept

Imagine the Proxy contract has a filing cabinet. The first drawer is "Owner," the second is "Balances." If a new upgrade thinks the first drawer is "Balances," it will overwrite the "Owner" data. This is called a __Storage Collision__, and it can accidentally give a random user control over the whole project.

The "Storage" Mix-up

New logic contracts often need an `initialize` function (like a "Start" button). If developers forget to press this button themselves, a hacker can press it first, claim ownership of the contract, and potentially destroy it, leaving the project "bricked" and unusable.

Forgetting to "Lock the Door"

Sometimes, a user’s command and an admin’s command look identical to the computer (like two different keys fitting the same lock). A hacker might find a "Logic" function that accidentally triggers an "Admin" upgrade. This is why many projects use __Transparent Proxies__ to separate user and admin paths.


Function Clashing

Upgrades usually have a __Timelock__ (a 24-48 hour warning). However, during urgent migrations, developers might remove this timer. While helpful for speed, it creates a "Trust Window" where a dishonest developer (or a hacker who stole the admin key) could upgrade the contract to a "thief version" and steal all funds instantly.

The "Rug Pull" Window

When moving tokens from one blockchain to another (like Ethereum to Polygon), the tokens are "locked" in a vault. If the upgrade to that vault has a tiny math error, a hacker might trick the vault into thinking they deposited millions of tokens, allowing them to withdraw the real funds on the other side.

The Bridge Risk

After a migration, the old contract often still exists. If users don't move their money to the new version, they might be left on an "abandoned ship" that the developers are no longer monitoring or patching, making it an easy target for attackers.

Abandoned Versions

Upgrades are usually approved by a group of people (a Multi-Sig). During the stress of a migration, these people might be more likely to fall for __Phishing attacks__. If a hacker tricks enough signers into approving a "maintenance" transaction, they could actually be approving a malicious upgrade.

The "Multi-Sig" Weakness

Take the Quiz

To make transactions completely free for everyone. 

To act as a middleman that allows "unchangeable" contracts to be updated. 


To speed up the internet connection of the blockchain.

It makes the file size of the contract too large to fit on the blockchain. 

It prevents the developers from ever upgrading the contract again. 

It causes the new code to overwrite important data, like who the "Owner" is. 


It causes the user's phone to crash when using the app.


It locks their tokens forever so they can't sell them. 

It gives them a warning period to withdraw their money if they don't trust a new upgrade. 

It makes the blockchain process transactions only at night. 


It sets a password on the contract that changes every hour.

The contract works perfectly and is more secure.

A hacker could "initialize" it themselves and take control of it.

The tokens in the contract will double in value automatically.

Nothing; the blockchain will fix it automatically.