Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

LevelTwo is not upgradeable — missing UUPSUpgradeable inheritance

hexspectre

Summary

The LevelTwo contract is intended to be used as a new implementation in the Hawk High UUPS upgrade pattern. However, it does not inherit from UUPSUpgradeable, which is required for compatibility with OpenZeppelin's upgrade mechanisms. As a result, any upgrade attempt from LevelOne to LevelTwo will revert with an error.

Vulnerability Details

The OpenZeppelin upgrade functions like upgradeTo() or _upgradeToAndCallUUPS() perform a safety check by calling:

IERC1822Proxiable(newImplementation).proxiableUUID()

This check only passes if the new implementation inherits UUPSUpgradeable and implements proxiableUUID() properly. Since LevelTwo currently only inherits Initializable, this call will revert, blocking the upgrade.

Impact

  • Upgrade from LevelOne → LevelTwo will fail

  • Future upgrades (LevelTwo → LevelThree) will also fail unless fixed

Tools Used

  • Manual code review

  • Remix test deployment with ERC1967Proxy

  • Reference to OpenZeppelin UUPSUpgradeable v5.3.0 source code

Recommendations

Update LevelTwo to inherit both base contracts:

import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
​
contract LevelTwo is Initializable, UUPSUpgradeable {
...
function _authorizeUpgrade(address newImpl) internal override {
require(msg.sender == principal); // same logic as LevelOne
}
}

This ensures:

  • The contract is compatible with UUPS proxies

  • The upgrade from LevelOne to LevelTwo succeeds

  • LevelTwo remains upgradeable to future versions (e.g., LevelThree)

Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.