How do you make sure an upgrade to a proxy-based contract does not corrupt storage or break the system?
What the interviewer wants to hear
- Understand delegatecall: storage lives in the proxy, layout must stay compatible
- Never reorder, remove or change types of existing variables; append only or use ERC-7201 namespaces
- Automated layout checks (OpenZeppelin upgrades plugin, forge inspect diff)
- Initializers and reinitializer versions, disable initializers on implementation
- Fork tests of the upgrade on real state, timelock and multisig execution
Model answer
Because a proxy delegatecalls into the implementation, all state lives in the proxy's storage, and the new implementation must read the same slots in the same way. So I never reorder, remove or change the type of existing variables, including in parent contracts. New state is appended, or better, kept in ERC-7201 namespaced structs as OpenZeppelin v5 does. I check this automatically: the OpenZeppelin upgrades plugin or a forge inspect storage layout diff in CI fails if the layout is incompatible. Any new setup runs in a reinitializer with a new version number, and the implementation's constructor calls _disableInitializers. Before going live I run the upgrade on a mainnet fork against real state and run the full test suite, including invariants, on the upgraded system. The upgrade itself goes through a multisig and timelock, with a clear rollback plan.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Blockchain Developer questions
- You are designing a new lending protocol. What are the biggest security risks and how do you address them?
- Why have cross-chain bridges been a common target for large hacks, and how would you design a safer cross-chain system?
- What is MEV, and how would you protect your protocol's users from harmful MEV?
- How do you prepare a codebase for a security audit, and what happens after the audit?
- How do you decide what logic and data should live on chain versus off chain in a dApp?
- Your protocol is being exploited right now on mainnet. What do you do in the first hour and afterwards?
- How does EIP-7702 change assumptions that smart contracts and dApps make about EOAs, and what would you change in your code?
- You are building an ERC-4626 yield vault. What design and security issues do you consider?
- Your team wants to deploy the same protocol to five EVM chains, including L2s. What can go wrong and how do you prepare?