Ted Chen · Projects
Upgrade Airlock
How it works
A proxy upgrade runs only after a block cooldown and an on-chain clearance. A Chainlink CRE workflow runs the new implementation against the proxy's real state, has a funded outside account call every new function, and compares supply, ownership and balances before and after. If the attack works, the upgrade gets a signed veto. A bytecode rule also catches code that behaves well in simulation but mints tokens on a real block.
Of the first ten proposals on the Sepolia testnet, the one honest upgrade was cleared and executed, and all nine test attacks were vetoed. I entered solo. Solidity and Foundry for the contracts, TypeScript for the workflow.
中文說明
proxy 升級要等區塊冷卻期結束、拿到鏈上放行才能執行。Chainlink CRE 工作流會把新實作放進 proxy 的真實狀態裡執行，讓一個有資金的陌生地址呼叫每個新函式，再比對前後的總供給量、擁有權和餘額；攻擊成功，升級就會收到簽章否決。
Sepolia 測試網上的前十個提案裡，唯一一個正常升級拿到放行並順利執行，九個測試攻擊全都被否決。ETH Shenzhen 2026 黑客松第二名，單人參賽。