Skip to content
attack.paths
Anmelden
← RegistryDossier · 4 steps · 3 edges

Uninitialised UUPS proxy implementation → brick contracts

UUPS upgradeable contracts must initialise the implementation contract itself. If skipped, anyone can call `initialise()` and become its owner — then call `selfdestruct` to brick every proxy referencing it (Parity Multisig 2017).

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target deployed UUPS proxies via OpenZeppelin Upgrades. The deploy script didn't disable initialisers on the implementation, or didn't disable selfdestruct semantics on pre-0.8.18 Solidity.

§ Steps

  1. 01
    Every proxy DELEGATECALL fails foreverImpact
    T1486— Data Encrypted for Impact
  2. 02
    Spot uninitialised implementation contractReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  3. 03
    Trigger selfdestruct via owner-only functionImpact
    T1485— Data Destruction
  4. 04
    Call initialize() — become ownerPrivilege Escalation
    W3-PROXY-INIT— Uninitialised UUPS Proxy Implementation

§ References

§ Frequently asked

What is the "Uninitialised UUPS proxy implementation → brick contracts" attack path?
UUPS upgradeable contracts must initialise the implementation contract itself. If skipped, anyone can call `initialise()` and become its owner — then call `selfdestruct` to brick every proxy referencing it (Parity Multisig 2017). It chains 4 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Every proxy DELEGATECALL fails forever (T1486) — a impact primitive. Assumed environment: target deployed UUPS proxies via OpenZeppelin Upgrades.
What is the final impact of this kill-chain?
The final step lands on Call initialize() — become owner (W3-PROXY-INIT), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers