Upgradeability Risk
The risk that the code holding your funds can be replaced with different code after you have deposited.
Upgradeable contracts use a proxy pattern: users interact with a permanent proxy address that stores the assets and forwards calls to a separate implementation contract whose address an administrator can change. This exists for a good reason, since bugs are otherwise unfixable, but it means the code a user reviewed is not necessarily the code that will run tomorrow. The main mitigations are timelocks giving users a published window to exit before a new implementation activates, restricting who may upgrade, and eventually freezing the implementation. Readers can check whether an address is a proxy and who controls the upgrade on a block explorer, alongside any timelock delay.
实际应用
Verifying source code on a block explorer confirms what the current implementation does; it says nothing about what the administrator may deploy next unless a timelock is in force.
常见的误解
That reading and verifying a contract's source protects you, when a contract behind an upgradeable proxy can have its logic swapped for something entirely different.