2026-08-02 12:58 UTC
In an upgradeable proxy, the funds live in the proxy and the logic is swappable. Own the pointer, own everything. This issue covers delegatecall storage collisions (Audius), uninitialized implementations (Wormhole's other bug), UUPS selfdestruct bricking (Parity froze 513k ETH), and the 2025 mempool bots front-running initialize() on fresh proxies. Plus slither-check-upgradeability to catch it. https://www.kayssel.com/newsletter/issue-61/
#InfoSec #CyberSecurity #Web3 #SmartContracts #BugBounty #DeFi
Replies (1)
-
@hannaB@social.vir.group 2026-08-06 07:27
@rsgbengi@infosec.exchange we had a similar scare with a token launch last year, someone tried to front-run the proxy init on testnet before we even deployed to mainnet. caught it by accident during a routine read of the bytecode, not by any tool.