# Slither errors in Openzeppelin's contracts-upgradeable

**URL:** <https://forum.openzeppelin.com/t/slither-errors-in-openzeppelins-contracts-upgradeable/29467>\
**Category:** Contracts\
**Tags:** erc721, upgrades\
**Created:** [June 8, 2022, 1:17pm UTC](https://forum.openzeppelin.com/t/slither-errors-in-openzeppelins-contracts-upgradeable/29467 "2022-06-08T13:17:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chainbaba](https://avatars.discourse-cdn.com/v4/letter/c/d78d45/32.png) [@chainbaba](https://forum.openzeppelin.com/u/chainbaba)\
**Post date:** [June 8, 2022, 1:17pm UTC](https://forum.openzeppelin.com/t/slither-errors-in-openzeppelins-contracts-upgradeable/29467/1 "2022-06-08T13:17:54Z")

</div>

Using openzeppelin's UUPS upgradeable proxy contracts results in the following slither error. Are they false positives or should I be concerned?

Enviornment:  
"@openzeppelin/contracts-upgradeable": "^4.5.2",

```auto
$ slither .
'npx hardhat compile --force' running
hardhat solidity version 0.8.9

```

Error 1:

```auto
ERC1967UpgradeUpgradeable._functionDelegateCall(address,bytes) (node_modules/@openzeppelin/contracts-upgradeable/proxy/ERC1967/ERC1967UpgradeUpgradeable.sol#198-204) uses delegatecall to a input-controlled function id
	- (success,returndata) = target.delegatecall(data) (node_modules/@openzeppelin/contracts-upgradeable/proxy/ERC1967/ERC1967UpgradeUpgradeable.sol#202)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#controlled-delegatecall

```

Error 2:

```auto
ERC1967UpgradeUpgradeable._upgradeToAndCallUUPS(address,bytes,bool).slot (node_modules/@openzeppelin/contracts-upgradeable/proxy/ERC1967/ERC1967UpgradeUpgradeable.sol#98) is a local variable never initialized
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#uninitialized-local-variables

```

Error 3:

```auto
ERC1967UpgradeUpgradeable._upgradeToAndCallUUPS(address,bytes,bool) (node_modules/@openzeppelin/contracts-upgradeable/proxy/ERC1967/ERC1967UpgradeUpgradeable.sol#87-105) ignores return value by IERC1822ProxiableUpgradeable(newImplementation).proxiableUUID() (node_modules/@openzeppelin/contracts-upgradeable/proxy/ERC1967/ERC1967UpgradeUpgradeable.sol#98-102)
ERC721Upgradeable._checkOnERC721Received(address,address,uint256,bytes) (node_modules/@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol#393-414) ignores return value by IERC721ReceiverUpgradeable(to).onERC721Received(_msgSender(),from,tokenId,_data) (node_modules/@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol#400-410)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#unused-return

```

---

<div class="post-metadata">

**Author:** ![frangio](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/frangio/32/15251_2.png) [@frangio](https://forum.openzeppelin.com/u/frangio)\
**Post date:** [June 8, 2022, 9:39pm UTC](https://forum.openzeppelin.com/t/slither-errors-in-openzeppelins-contracts-upgradeable/29467/2 "2022-06-08T21:39:47Z")

</div>

Errors 2 and 3 are a false positive in Slither. This is the bug: [https://github.com/crytic/slither/issues/982](https://github.com/crytic/slither/issues/982)

Error 1 is correct, the function id is input-controlled, but this is only ever exposed to privileged accounts (upgrade role, or owner), so it is trusted.