Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Improper Use of _authorizeUpgrade() – Upgrade Not Executed in graduateAndUpgrade

bryanconquer

Summary

The graduateAndUpgrade function incorrectly attempts to authorize an upgrade by calling _authorizeUpgrade(_levelTwo) manually. However, in the UUPSUpgradeable pattern, _authorizeUpgrade is an internal function meant to be overridden to control access. It is automatically called by OpenZeppelin's internal _upgradeTo() or _upgradeToAndCall() functions, not intended to be called directly. As a result, the contract fails to perform the actual upgrade, and the new implementation is not activated.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/3a7251910c31739505a8699c7a0fc1b7de2c30b5/src\LevelOne.sol#L305-L305

_authorizeUpgrade(_levelTwo) is called directly, which does nothing to change the proxy's implementation.

  • The actual upgrade to _levelTwo does not occur.

  • Misleads users into thinking an upgrade has happened, while the logic remains on the old implementation.

Impact

fails to perform the actual upgrade, and the new implementation is not activated.

Tools Used

manual review

Recommendations

Replace the call to _authorizeUpgrade() with a proper upgrade execution


_upgradeTo(_levelTwo);
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.