-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Complete unit test coverage for upgradeable renouncable proxy #112
Conversation
…n/non-admin with selector clashes
solves #90 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great work!
I left small questions, you can see whether they need resolving or not; happy to merge following your response
import {ERC1967Utils} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Utils.sol"; | ||
import { | ||
UpgradeableRenounceableProxy, IUpgradeableRenounceableProxy | ||
} from "src/groups/UpgradeableRenounceableProxy.sol"; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can't believe I never realised using an absolute path is so much more readable and better. Internal style-guide updated !
test/groups/upgradeableProxy/adminOperationsUpgradeableRenounceableProxy.t.sol
Outdated
Show resolved
Hide resolved
test/groups/upgradeableProxy/adminOperationsUpgradeableRenounceableProxy.t.sol
Show resolved
Hide resolved
…eableProxy.t.sol improve comment clarity for internal function _upgradeToAndCall
…eableProxy.t.sol fix missed vm.prank
both questions resolved. LGTM! |
Two mock contracts were implemented to test the behavior of the upgradeable renounceable proxy under different scenarios:
Tested:
During testing, a serious issue was discovered where the proxy's native functionality can be bypassed by a malicious implementation. Specifically:
Proxy Admin & Implementation: any address (not just the proxy admin) can change the proxy's admin and implementation. This is a critical vulnerability, if we have a constraint that only proxy native functionality can change admin and implementation.
Given the findings, conclusion is that fixes are required in the proxy contract to address these security issues and ensure the integrity of the upgradeable renouncable proxy functionality.