Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Proxy won't be upgraded with new implementation contract

0xziin

Summary

The Proxy won't be upgraded with the new implementation contract (Level2.sol) because there is no function called inside graduateAndUpgrade() that performs the actual change of the implementation contract address.

Vulnerability Details

The Proxy contract stores the address of the implementation contract to point to when delegatecall.
With UUPSUpgradeable mechanism, the set up of a new implementation contract address is normally processed by a function inside the actual implementation contract : LevelOne.sol
But here in LevelOne.sol there is no call to an upgrade of the implementation contract address. Only a call to the __AuthorizeUpgrade() function which is only present to restrict access for an upgrade.

According to Openzeppelin : upgradeToAndCall() should be used to upgrade the implementation contract.

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/main/src/LevelOne.sol#L305

function graduateAndUpgrade(address _levelTwo, bytes memory) public onlyPrincipal {
if (_levelTwo == address(0)) {
revert HH__ZeroAddress();
}
​
uint256 totalTeachers = listOfTeachers.length;
​
uint256 payPerTeacher = (bursary * TEACHER_WAGE) / PRECISION;
uint256 principalPay = (bursary * PRINCIPAL_WAGE) / PRECISION;
​
_authorizeUpgrade(_levelTwo); // <- Do not perform the upgrade, only authorize it
...

Impact

No upgrade can be performed.

Tools Used

GitHub, Manual review.

Recommendations

Use upgradeToAndCall() inside graduateAndUpgrade() to perform the actual upgrade of the implementation contract.

function upgradeToAndCall(address newImplementation, bytes memory data) public payable virtual onlyProxy {
_authorizeUpgrade(newImplementation);
_upgradeToAndCallUUPS(newImplementation, data);
}

Updates

Lead Judging Commences

yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.