Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Direct call to _authorizeUpgrade prevents contract upgrade

anchabadze

Description:

The graduateAndUpgrade function in the LevelOne contract directly calls the internal _authorizeUpgrade function instead of calling the upgradeToAndCall function from the UUPSUpgradeable contract. This is a critical error in the implementation of the UUPS upgrade pattern.

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
// ...
_authorizeUpgrade(_levelTwo); // Direct call to _authorizeUpgrade
// Should be: upgradeToAndCall(_levelTwo, "");
// ...
}
​

In the UUPS pattern, the _authorizeUpgrade() function is only meant to check authorization for an upgrade, not to perform the upgrade itself. The actual upgrade logic is implemented in the _upgradeToAndCallUUPS() function, which is called by upgradeToAndCall() after authorization is confirmed.

Impact:

  • The contract cannot be upgraded to LevelTwo, making the upgrade functionality completely broken

  • The principal and users may believe an upgrade has occurred when it hasn't

  • The school cannot progress to the next level as intended

Recommended Mitigation:

Replace the direct call to _authorizeUpgrade with a call to upgradeToAndCall in the graduateAndUpgrade function

Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.