Summary

Without restricting access to _authorizeUpgrade, any entity could invoke this function, leading to unauthorized and potentially malicious upgrades.

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/proxy/utils/UUPSUpgradeable.sol#L126

Vulnerability Details

Impact

This could allow an attacker to replace the contract logic with malicious code, steal funds, or disrupt the contract’s intended functionality.

Tools Used

Manual review

Recommendations

Add onlyOwner modifier to _authorizeUpgrade