Upgradeable Contracts and Proxies

How a Proxy Separates Address From Code

You send transactions to the proxy. The proxy forwards them to an implementation contract, which runs its code against the proxy's storage. OpenZeppelin describes the arrangement bluntly: the logic contract controls the proxy's state, and the logic contract's own state is meaningless.

Upgrading is therefore not a migration, and nothing moves house. It changes one stored address. Your balance sits in the proxy throughout, entirely indifferent to which code is currently in charge of it.

Where the Pointers Live

If the implementation address lived in an ordinary variable it could collide with the implementation's own variables, which would be memorable for all the wrong reasons. ERC-1967 avoids that by pinning the pointers to fixed pseudo random slots, each derived as the hash of a label minus one. The implementation slot is 0x360894a1…d382bbc and the admin slot is 0xb5312768…0b5d6103.

That standardisation is genuinely useful to you and not just to developers. Because the slots are fixed and public, anyone can read a proxy's current implementation and its admin straight from chain state, with no source code and nobody's permission.

Who Holds the Key

In the transparent pattern a separate admin contract holds that authority. In the UUPS pattern the upgrade function lives in the implementation behind an authorisation check. The difference is where the function sits, not how much power it grants. Either way, whoever passes the check can swap the logic.

A timelock is the usual answer. OpenZeppelin's TimelockController enforces a minimum delay between an upgrade being proposed and executed, with separate roles to propose, execute and cancel. What it buys is a public warning window rather than immunity, and a warning window is worth roughly nothing to a user who is not watching for it, which is most of us, most of the time.

What This Means for "Code Is Law"

The practical rule: before trusting a protocol with a meaningful balance, establish whether it is upgradeable, who can upgrade it, and whether a delay stands in the way. Code you read today describes how the system behaves today. If an admin key can rewrite it, your real counterparty is whoever holds that key, and the audited source is a photograph rather than a contract.