The Dark Side of Upgrades: Uncovering Security Risks in Smart Contract Upgrades

2025-08-04

AI Summary

Smart contract upgradability enhances flexibility but critically undermines immutability, introducing novel security risks. Existing research lacks systematic empirical evidence and fine-grained risk categorization. To address this gap, we construct the first large-scale dataset of upgrade behaviors—comprising 83,085 upgraded contracts and 20,902 upgrade chains—and propose an eight-category taxonomy of insecure upgrade practices, grounded in real-world security incidents. We further identify four previously overlooked, upgrade-specific risks for which no effective mitigations currently exist. Our methodology integrates static analysis, on-chain behavioral mining, and in-depth case studies to enable end-to-end tracing and risk detection across the entire upgrade lifecycle. This approach uncovers 31,407 potential vulnerabilities, exposing critical blind spots in current defense mechanisms. The study provides both foundational data infrastructure and actionable insights for securing upgradeable smart contracts.

Technology Category

• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty
• Natural Language Processing: Safety and Robustness
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity

Abstract

Smart contract upgrades are increasingly common due to their flexibility in modifying deployed contracts, such as fixing bugs or adding new functionalities. Meanwhile, upgrades compromise the immutability of contracts, introducing significant security concerns. While existing research has explored the security impacts of contract upgrades, these studies are limited in collection of upgrade behaviors and identification of insecurities. To address these limitations, we conduct a comprehensive study on the insecurities of upgrade behaviors. First, we build a dataset containing 83,085 upgraded contracts and 20,902 upgrade chains. To our knowledge, this is the first large-scale dataset about upgrade behaviors, revealing their diversity and exposing gaps in public disclosure. Next, we develop a taxonomy of insecurities based on 37 real-world security incidents, categorizing eight types of upgrade risks and providing the first complete view of upgrade-related insecurities. Finally, we survey public awareness of these risks and existing mitigations. Our findings show that four types of security risks are overlooked by the public and lack mitigation measures. We detect these upgrade risks through a preliminary study, identifying 31,407 related issues - a finding that raises significant concerns.

Problem

• Identifying security risks in smart contract upgrades
• Analyzing diverse upgrade behaviors and their insecurities
• Assessing public awareness and mitigation of upgrade risks

Innovation

• Built large-scale dataset on smart contract upgrades
• Developed taxonomy of eight upgrade insecurity types
• Detected 31,407 overlooked upgrade security issues