Hawk High

Summary

The functiongraduateAndUpgrade does not allow updating the address of a UUPS proxy implementation

Vulnerability Details

The function to upgrade a proxy with the Openzeppelin library UUPS is upgradeToAndCall. This function calls _authorizeUpgradeto check the access control.

If the principal upgrade the contract LevelOne by calling this function, the contract UUPS will be upgrade to LevelTwo without calling the function graduateAndUpgrade

If the principal calls instead graduateAndUpgrade

This will not actually change the implementation that the UUPS points to since _authorizeUpgradedoes not change the implementation address stored in the proxy.

Reference: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/proxy/utils/UUPSUpgradeable.sol#L86

Impact

It is not possible to upgrade the proxy while calling the `graduateAndCall` function

Tools Used

Manual analysis

Recommendations

• Set the function graduateAndUpgradeinternal instead of public

• Call the function graduateAndUpgradeinside the function _authorizeUpgrade