Subtleties of upgradeable contracts

[abcoathup]

Hi @realisation

Some subtleties to consider with upgradeable contracts using the OpenZeppelin SDK:
(I split this into a new topic as I thought it was an interesting discussion on its own.)

Upgrades Pattern

Suggest reading about the upgrades pattern (if you haven't already): https://docs.openzeppelin.com/sdk/2.5/pattern

Governance

Need to consider the governance mechanisms to decide when and how to upgrade the contracts that will earn the trust of users:

Governance for Smart Contract Upgrades

Verify

Currently we can verify logic contracts on Etherscan with OpenZeppelin SDK and we can manually verify proxy contracts on Etherscan.
Etherscan doesn't currently support OpenZeppelin SDK proxy contracts.

Verify with OpenZeppelin SDK

Verify with OpenZeppelin SDK OpenZeppelin SDK supports verifying logic contracts with openzeppelin verify. There is an open issue to support verifying proxy contracts: https://github.com/OpenZeppelin/openzeppelin-sdk/issues/937 The following guide walks through verifying a logic contract. (I used openzeppelin 2.5.2) Note: Etherscan doesn’t currently support proxy contracts. EIP-1967 aims to create a standard that blockchain explorers could then implement. Currently, if you verify the proxy …

Audits

Suggest reading the audits of the OpenZeppelin SDK contracts:

ZeppelinOS Smart Contracts Audit IV