Sparkn

Summary

The developer commented on the Distributor contract, stating that although the contract is immutable after deployment, we can still upgrade the implementation contract by deploying a new one and changing the implementation address of the proxy contract. However, there are a few things that make this impossible.

1. The _implementation variable in Proxy.sol is declared as immutable.

2. Missing an upgrading function.

Vulnerability Details

1. The _implementation variable in Proxy.sol is declared as immutable, preventing the implementation address from being changed after deployment. As a result, the proxy contract cannot be upgraded.

2. This contract cannot be upgraded because neither Proxy.sol nor Distributor.sol define an upgrading function. Therefore, there is no handle or entry point to upgrade the implementation contract.

Impact

The proxy contract cannot be upgraded.

Tools Used

None

Recommendations

Use ERC1967Proxy.sol and UUPSUpgradeable.sol from Openzeppelin.