Upgradeability is power that must be guarded

Graduate · enrolled learners

This lesson opens with PAID Network, March 2021.

What happened

PAID Network used an upgradeable contract, meaning its logic could be replaced by whoever controlled the upgrade. An attacker gained control of that upgrade power, through a compromised deployer, upgraded the contract to a malicious version, and used it to mint about 59 million new PAID tokens out of nothing, crashing the token's price by roughly 85 percent. They dumped some of the minted supply for around 3 million dollars in ether before the team paused the system, and the notional damage to holders ran to tens of millions; PAID later snapshotted balances and re-minted to restore holders. No cryptography was broken and the token contract's normal rules were never the issue: the attacker did not exploit the logic, they replaced it, because controlling the upgrade meant controlling the contract. The right to upgrade was the right to rewrite every rule the contract enforced, and once the attacker held it, the contract did whatever they now wrote it to do.

The decision point

An upgrade mechanism is the power to replace a contract's entire logic, so whoever controls the upgrade controls everything the contract can do, which makes upgradeability not a convenience but a concentrated privilege more dangerous than any single function. PAID Network is the case: an attacker who gained control of the upgrade power replaced the contract with a malicious version and minted about 59 million tokens from nothing, causing tens of millions in notional damage, not by exploiting the contract's logic but by rewriting it. This follows directly from the prior lesson: since a contract is code over state and the code defines what the state means, the ability to change the code is the ability to change everything, so an upgrade key is the master key, and it must be guarded exactly like, and more carefully than, the most dangerous function in the contract. A single deployer key that can upgrade is a single point at which someone can rewrite the whole system, which is why upgrade power belongs behind a multisig, so no one person holds it, and a timelock, so a malicious upgrade is visible and delayable before it takes effect. So the discipline is to treat the upgrade mechanism as the highest-value target in the system, to never let it rest on a single key, and to make any upgrade slow and visible, because the right to upgrade is the right to rewrite the contract under users' feet, and PAID Network is what that right does in the wrong hands: it turns the contract into whatever the attacker now wants it to be.

Recorded loss

$27,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.