What is an upgradeable contract proxy?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
A proxy splits the contract you interact with from the contract holding the logic, so the logic can be replaced. That makes bug fixes possible, and in return introduces a trust assumption: whoever holds the upgrade key can change how the contract behaves. Users need to know who that is.
Key points
- Splits the entry point from the logic so logic can be swapped
- Bugs can be fixed and features added
- It carries the assumption that an admin can change behaviour
- The address stays the same, so swaps are easy to miss
Definition
A structure in which the contract users call forwards to a separate contract holding the logic. Changing the forwarding target updates behaviour while keeping the same address.
Deployed contract code cannot be rewritten. In reality, though, bugs surface and features get added. A proxy separates the contract holding state and the entry point from the contract holding the logic, and swaps only the address pointing at the latter.
From the outside, the address users and other contracts call never changes, and balances and settings stay on the entry-point side. That removes migration effort — and equally means an upgrade leaves no outward trace.
The contrast is a design with no upgrade path at all (see immutable-contract). Neither is better; they rest on different assumptions. A proxy can be fixed but requires trusting an administrator, while an unchangeable contract requires no such trust but cannot be repaired. The choice follows the use case.
Watch out for
- · Whoever holds the upgrade key can change behaviour without users' consent
- · If that key is a single account, its compromise means the logic can be rewritten
- · A past audit says nothing about the code deployed after an upgrade