The OWASP Smart Contract Top 10 for 2026 just introduced SC10: Proxy & Upgradeability Vulnerabilities as a new category. This is significant—it made the list because enough projects suffered major losses from upgrade mechanisms in 2025.
The Core Issue
Proxy patterns let you upgrade smart contracts, but they introduce serious security risks:
- Storage collisions can corrupt critical state
- Uninitialized proxies let attackers take control
- Governance vulnerabilities in upgrade mechanisms
- Implementation bugs that can brick entire protocols
According to OWASP 2026, proxy-related vulnerabilities contributed to multiple high-profile losses last year. These weren’t simple coding errors—they were architectural decisions that introduced centralization risks.
The Question
Did we sacrifice “code is law” immutability for VC demands to have control? Many protocols market as “decentralized” while having multisigs that can upgrade the entire codebase with minimal notice.
For the community: How do you balance upgradeability vs. security? What governance models work best?