输入您的职位名称

职位名称

名称

核心小组所在国家在国际司法合作、刑事司法系统、反洗钱和腐败方面的综合评分较低。这些背景数据表明，预防和减少欺诈的难度和复杂性都在增加。

核心小组所在的国家在国际司法合作、刑事司法系统、反洗钱和腐败方面的综合评级为中等。这些背景数据表明，地域问责制处于中等水平，从而降低和减轻了欺诈风险。

核心小组所在的国家在国际司法合作、刑事司法系统、反洗钱和腐败方面的综合评分最高。这些背景数据表明，地域问责制的水平最高，从而最大限度地减少和降低了风险。

Upgrading a Web3 project is like trying to change the tires on a racecar while it’s driving at 200 mph. Because blockchains are meant to be "permanent," developers use clever tricks to update code, but these tricks create unique backdoors for hackers.

Attack surfaces introduced by upgrades and migrations

Read and Learn

Since you can't change code once it's on the blockchain, developers use a __Proxy__. Think of the Proxy as a "Phone Operator" and the Logic as the "Department." Users call the Operator, who forwards the call to the Department. An upgrade just tells the Operator to forward calls to a new Department.

The "Proxy" Concept

Imagine the Proxy contract has a filing cabinet. The first drawer is "Owner," the second is "Balances." If a new upgrade thinks the first drawer is "Balances," it will overwrite the "Owner" data. This is called a __Storage Collision__, and it can accidentally give a random user control over the whole project.

The "Storage" Mix-up

New logic contracts often need an `initialize` function (like a "Start" button). If developers forget to press this button themselves, a hacker can press it first, claim ownership of the contract, and potentially destroy it, leaving the project "bricked" and unusable.

Forgetting to "Lock the Door"

Sometimes, a user’s command and an admin’s command look identical to the computer (like two different keys fitting the same lock). A hacker might find a "Logic" function that accidentally triggers an "Admin" upgrade. This is why many projects use __Transparent Proxies__ to separate user and admin paths.


Function Clashing

Upgrades usually have a __Timelock__ (a 24-48 hour warning). However, during urgent migrations, developers might remove this timer. While helpful for speed, it creates a "Trust Window" where a dishonest developer (or a hacker who stole the admin key) could upgrade the contract to a "thief version" and steal all funds instantly.

The "Rug Pull" Window

When moving tokens from one blockchain to another (like Ethereum to Polygon), the tokens are "locked" in a vault. If the upgrade to that vault has a tiny math error, a hacker might trick the vault into thinking they deposited millions of tokens, allowing them to withdraw the real funds on the other side.

The Bridge Risk

After a migration, the old contract often still exists. If users don't move their money to the new version, they might be left on an "abandoned ship" that the developers are no longer monitoring or patching, making it an easy target for attackers.

Abandoned Versions

Upgrades are usually approved by a group of people (a Multi-Sig). During the stress of a migration, these people might be more likely to fall for __Phishing attacks__. If a hacker tricks enough signers into approving a "maintenance" transaction, they could actually be approving a malicious upgrade.

The "Multi-Sig" Weakness

Take the Quiz

To make transactions completely free for everyone. 

To act as a middleman that allows "unchangeable" contracts to be updated. 


To speed up the internet connection of the blockchain.

It makes the file size of the contract too large to fit on the blockchain. 

It prevents the developers from ever upgrading the contract again. 

It causes the new code to overwrite important data, like who the "Owner" is. 


It causes the user's phone to crash when using the app.


It locks their tokens forever so they can't sell them. 

It gives them a warning period to withdraw their money if they don't trust a new upgrade. 

It makes the blockchain process transactions only at night. 


It sets a password on the contract that changes every hour.

The contract works perfectly and is more secure.

A hacker could "initialize" it themselves and take control of it.

The tokens in the contract will double in value automatically.

Nothing; the blockchain will fix it automatically.