UUPS Proxy
An upgradeable proxy pattern in which the upgrade function and its authorization check live in the implementation contract, so whoever passes that check can replace the contract's code.
UUPS (Universal Upgradeable Proxy Standard) is a variant of the proxy pattern. The proxy holds the storage and delegates every call to an implementation contract. Unlike a transparent proxy, the logic for changing that implementation is not in the proxy: it lives in the implementation itself, typically as upgradeToAndCall.
In OpenZeppelin's UUPSUpgradeable, every upgrade calls an internal hook, _authorizeUpgrade, which the developer overrides to decide who may upgrade. That one function is the most powerful access check in the contract. Whoever passes it can swap in new code that removes every other check, or adds a new function such as an unrestricted mint.
For that reason the upgrade right is usually held by its own role, granted only to a multi-signature wallet acting through a timelock, so an upgrade is public and cancellable before it takes effect. Leaving it with a single externally owned account means one leaked key can rewrite the contract.
Related Terms
Proxy Pattern
Smart contract design separating storage and logic, enabling upgrades by changing implementation while preserving state.
Timelock
Smart contract mechanism enforcing mandatory delay between initiating and executing critical protocol changes for transparency.
Role-Based Access Control (RBAC)
An access control pattern where permissions are assigned to roles, and roles are assigned to addresses, enabling granular and flexible authorization.
Multi-signature Wallet
A cryptocurrency wallet requiring multiple private key signatures to authorize transactions, distributing trust.
Need expert guidance on UUPS Proxy?
Our team at Zealynx has deep expertise in blockchain security and DeFi protocols. Whether you need an audit or consultation, we're here to help.
Get a Quote