> For the complete documentation index, see [llms.txt](https://docs.optimumsec.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.optimumsec.xyz/ongoing-upgrades/key-considerations-upgrade-reviews.md).

# Key Considerations for the Security Review of Upgrades

Ensuring the security of a contract upgrade requires a focused review process tailored to the unique risks that upgrades introduce. While it may seem tempting to focus only on the newly added code, this approach is insufficient.

A thorough security review must consider all state variables affected by the upgrade and re-examine any previously deployed code these changes interact with. Even if the original code was reviewed before deployment, revisiting it ensures that no hidden vulnerabilities are exposed by the upgrade.

***

Below are actionable tips to guide a comprehensive security review of your upgraded contract:

## 1. Confirm Compatibility with Existing Functionality

* **Test for Backward Compatibility:** Verify that all previously supported functions and interfaces behave as expected.
* **Check Dependent Contracts:** Ensure contracts or systems interacting with the upgraded contract remain functional.

## 2. Assess Changes to Storage Layout

* **Validate Storage Consistency:** If using a proxy pattern, confirm that storage layout changes do not introduce corruption.
* **Use Tools:** Employ tools like OpenZeppelin's storage layout comparison to identify potential mismatches.

## 3. Review New and Modified Code

* **Audit New Logic:** Scrutinize any newly introduced functionality for vulnerabilities or design flaws.
* **Verify Fixes:** Confirm that updates addressing previously identified vulnerabilities do not introduce new issues.
* **Revisit Touched Code:** Reassess previously reviewed code that interacts with updated state variables or new logic to ensure the upgrade doesn't expose vulnerabilities in older code.
* **Review State Migration Scripts:** Examine any scripts or mechanisms used for migrating state to ensure correctness and prevent corruption or unintended consequences.

## 4. Conduct Thorough Tests on Testnets

* **Simulate Real-World Scenarios:** Test the upgraded contract in environments similar to mainnet.
* **Integration Tests:** Ensure smooth interactions with other contracts and off-chain systems.

## 5. Review Documentation

* **Upgrade Notes:** Include detailed descriptions of changes made in the upgrade.
* **Migration Plans:** Document the state migration process and any data transformations required.

## 6. Involve External Security Researchers

* **Expert Review:** Engage third-party security researchers to evaluate the upgrade.
* **Independent Testing:** Ensure researchers independently verify your internal findings.