Abstract
A smart contract that is deployed to a blockchain system like Ethereum is, under reasonable circumstances, expected to be immutable and tamper-proof. This is both a feature (promoting integrity and transparency) and a bug (preventing security patches and feature updates). Modern smart contracts use software tricks to enable upgradeability, raising the research questions of how upgradeability is achieved and who is authorized to make changes. In this paper, we summarize and evaluate six upgradeability patterns. We develop a measurement framework for finding how many upgradeable contracts are on Ethereum that use certain prominent upgrade patters. We find 1.4 million proxy contracts which 8,225 of them are unique upgradeable proxy contracts. We also measure how they implement access control over their upgradeability: about 50% are controlled by a single Externally Owned Address (EOA), and about 14% are controlled by multi-signature wallets in which a limited number of persons can change the whole logic of the contract.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
Specifically: \(\textsf{addr} \leftarrow \mathcal {H}(\texttt{0xff} \Vert \textsf{factoryAddr} \Vert \textsf{salt} \Vert \mathcal {H} (\textsf{initBytecode} \Vert \textsf{initBytecodeParams}))\).
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
0xd23cfffa066f81c7640e3f0dc8bb2958f7686d1f.
- 13.
- 14.
Storage slot 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103.
- 15.
References
Bent update. Technical report, Bent Finance. https://bentfi.medium.com/bent-update-12ae69a41dc6
Contract upgrade anti-patterns. Technical report, Trail of Bits. https://blog.trailofbits.com/2018/09/05/contract-upgrade-anti-patterns/
The state of defi security 2021. Technical report, Certik Company. https://blog.openzeppelin.com/the-state-of-smart-contract-upgrades/
Buterin, V.: Delegatecall forwarders: how to save 50–98 contracts with the same code. https://www.reddit.com/r/ethereum/comments/6c1jui/delegatecall_forwarders_how_to_save_5098_on/
Chen, J., Xia, X., Lo, D., Grundy, J.: Why do smart contracts self-destruct? investigating the selfdestruct function on ethereum. ACM Trans. Softw. Eng. Methodol. (TOSEM) 31(2), 1–37 (2021)
Chen, T., et al.: An adaptive gas cost mechanism for ethereum to defend against under-priced DoS attacks. In: Liu, J.K., Samarati, P. (eds.) ISPEC 2017. LNCS, vol. 10701, pp. 3–24. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-72359-4_1
Dhillon, V., Metcalf, D., Hooper, M.: The DAO hacked. In: Blockchain Enabled Applications, pp. 67–78. Apress, Berkeley, CA (2017). https://doi.org/10.1007/978-1-4842-3081-7_6
Fröwis, M., Böhme, R.: Not all code are Create2 equal. https://informationsecurity.uibk.ac.at/pdfs/FB-Ethereum-Create2.pdf
He, N., Wu, L., Wang, H., Guo, Y., Jiang, X.: Characterizing code clones in the ethereum smart contract ecosystem. In: Bonneau, J., Heninger, N. (eds.) FC 2020. LNCS, vol. 12059, pp. 654–675. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-51280-4_35
McCorry, P., Buckland, C., Yee, B., Song, D.: Sok: Validating bridges as a scaling solution for blockchains. Cryptology ePrint Archive (2021)
Murray, P., Welch, N., Messerman, J.: Minimal proxy contract. EIP-1167 (2018)
Ortner, M., Eskandari, S.: Smart contract sanctuary. https://github.com/tintinweb/smart-contract-sanctuary
PALLADINO, S.: The state of smart contract upgrades. https://blog.openzeppelin.com/the-state-of-smart-contract-upgrades/
Perez, D., Gudgeon, L.: Dissimilar redundancy in defi. arXiv preprint arXiv:2201.12563 (2022)
Perez, D., Livshits, B.: Broken metre: attacking resource metering in EVM. arXiv preprint arXiv:1909.07220 (2019)
Pinna, A., Ibba, S., Baralla, G., Tonelli, R., Marchesi, M.: A massive analysis of Ethereum smart contracts empirical study and code metrics. IEEE Access 7, 78194–78213 (2019)
Reijsbergen, D., Sridhar, S., Monnot, B., Leonardos, S., Skoulakis, S., Piliouras, G.: Transaction fees on a honeymoon: Ethereum’s eip-1559 one month later. In: 2021 IEEE International Conference on Blockchain (Blockchain), pp. 196–204. IEEE (2021)
Rodler, M., Li, W., Karame, G.O., Davi, L.: \(\{\)EVMPatch\(\}\): timely and automated patching of ethereum smart contracts. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 1289–1306 (2021)
Salehi, M., Clark, J., Mannan, M.: Not so immutable: Upgradeability of smart contracts on ethereum. Technical report, arXiv (2022)
Victor, F., Lüders, B.K.: Measuring ethereum-based ERC20 token networks. In: Goldberg, I., Moore, T. (eds.) FC 2019. LNCS, vol. 11598, pp. 113–129. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-32101-7_8
Walch, A.: The path of the blockchain lexicon (and the law). Rev. Bank. Fin. L. 36, 713 (2016)
Acknowledgements
Our measurements were possible thanks to https://archivenode.io/. We thank Santiago Palladino (OpenZeppelin) and the reviewers for comments and discussions that helped to improve our paper. J. Clark acknowledges support for this research project from the National Sciences and Engineering Research Council (NSERC), Raymond Chabot Grant Thornton, and Catallaxy Industrial Research Chair in Blockchain Technologies and the AMF (Autorité des Marchés Financiers). J. Clark and M. Mannan acknowledge NSERC through Discovery Grants.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 International Financial Cryptography Association
About this paper
Cite this paper
Salehi, M., Clark, J., Mannan, M. (2023). Not so Immutable: Upgradeability of Smart Contracts on Ethereum. In: Matsuo, S., et al. Financial Cryptography and Data Security. FC 2022 International Workshops. FC 2022. Lecture Notes in Computer Science, vol 13412. Springer, Cham. https://doi.org/10.1007/978-3-031-32415-4_33
Download citation
DOI: https://doi.org/10.1007/978-3-031-32415-4_33
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-32414-7
Online ISBN: 978-3-031-32415-4
eBook Packages: Computer ScienceComputer Science (R0)