{"id":"2f848a96-9829-4c35-b964-2ba64d93cb69","arxiv_id":"2508.02145","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"A large-scale study of upgraded smart contracts finds eight upgrade-related risk types, four of which are publicly overlooked and unmitigated, and reports 31,407 detected issue instances.","lead":"This paper builds a large dataset of 83,085 upgraded smart contracts and 20,902 upgrade chains, develops a taxonomy of eight upgrade-related security risk types from 37 real incidents, and reports that four of those risk types are overlooked and unmitigated. It then detects 31,407 instances of these risks, raising concerns about upgrade security in deployed contracts.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 31,407-issue count and the 'overlooked by the public' claim rest on an unstated detection rule and unvalidated dataset construction, and the supplied full text is a different paper, so the central empirical claim is not auditable.","rationale":"The reader correctly identified dataset construction and the completeness of the taxonomy as the weakest assumptions. My review agrees and sharpens the point: even before taxonomy completeness, the numerical headline of 31,407 issues cannot be evaluated without knowing the detection rule and its false-positive rate. The provided full text is arXiv:2508.02144 (BiFuzz), not the claimed smart-contract-upgrade paper, so the manuscript's methods are inaccessible. Because no evidence is available to confirm or refute the abstract's claims, the appropriate verdict remains UNVERDICTED, matching the reader's judgment. No change in verdict is warranted from this stress-test pass; the recommended check is a methodology audit of the actual paper once available.","tokens_in":4423,"tokens_out":2378,"duration_ms":34310,"concrete_test":"Obtain the actual manuscript's methodology section and re-run its upgrade-issue detector on a random sample of 100 contracts flagged as upgraded. For each sample contract, manually verify: (a) whether an actual upgrade event occurred on-chain (e.g., an implementation-slot change or a proxy admin call), and (b) whether the flagged issue is exploitable or merely an upgrade-related code pattern. Report precision and the distribution of issue counts per contract. If precision is below 50%, or if a small number of contracts produce the majority of the 31,407 issues, the headline count materially overstates the identified risk.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that a preliminary detection finds 31,407 upgrade-related security issues and that four of eight risk types are publicly overlooked and lack mitigation. For that claim to hold, three conditions must be true: (1) the 83,085 upgraded contracts and 20,902 upgrade chains are identified correctly; (2) the eight-type taxonomy derived from 37 incidents is complete enough that 'overlooked' is not a taxonomy artifact; and (3) the detection step that yields 31,407 issues has a definition of 'issue' that maps to actual insecurity rather than to a broad pattern such as 'uses a proxy pattern' or 'has an admin function'. The abstract provides no details on any of these. In particular, the 31,407 figure is uninterpretable without knowing the detector's precision, whether one contract can contribute multiple issues, and whether the count is unique contracts or issue instances. The statement that four risk types 'lack mitigation measures' additionally depends on the completeness of a public-awareness survey, which is not described. Because the provided full text is the BiFuzz video-game fuzzing paper and not this manuscript, these assumptions cannot be checked from the available evidence. This is not an internal contradiction; it is an unverified empirical claim that is load-bearing for the paper's headline conclusions.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The abstract announces a large-scale empirical study of security risks in smart contract upgrades, reporting a dataset of 83,085 upgraded contracts and 20,902 upgrade chains, a taxonomy of eight risk types derived from 37 real-world incidents, a survey of public awareness and mitigations, and a preliminary detection that identifies 31,407 issues. The submitted full text, however, is an unrelated paper titled 'BiFuzz: A Two-Stage Fuzzing Tool for Open-World Video Games' by Kato et al., containing no methodology, data, or results about smart contracts or upgrades. The manuscript therefore does not contain the study its title and abstract describe.","tokens_in":4700,"tokens_out":2240,"duration_ms":25878,"significance":"If the abstract's claims were fully substantiated by a matching manuscript, the work would be significant for smart contract security: a large upgrade-behavior dataset, an incident-derived taxonomy, and a public-awareness gap analysis could inform tooling and policy. However, in the submitted form the full text is a different paper, and the abstract alone provides no methodological detail, validation, or error bounds for any of the reported quantities. The contribution cannot be evaluated or credited on the available evidence.","major_comments":[{"comment":"The manuscript body is not the paper announced by the title and abstract. The full text is 'BiFuzz: A Two-Stage Fuzzing Tool for Open-World Video Games', with no mention of smart contracts, upgrades, security incidents, or the reported dataset. Consequently, the abstract's central empirical claims (83,085 upgraded contracts, 20,902 upgrade chains, 37 incidents, eight risk types, 31,407 issues) are entirely unsubstantiated in the submitted text. This is a load-bearing defect that cannot be repaired by local revision of the present document.","section":"Full text, Sections I–V"},{"comment":"Even taking the abstract on its own, the 31,407-issue count is not interpretable without a definition of an 'issue', the detection rule used, whether the count is unique contracts or issue instances, and any precision or false-positive analysis. The abstract states only that the detection is preliminary; without these details, the headline number cannot be audited or compared with other studies.","section":"Abstract, 'we detect these upgrade risks'"},{"comment":"The claim that four of the eight risk types are 'overlooked by the public and lack mitigation measures' depends on the completeness of both the incident-derived taxonomy and the public-awareness survey. The abstract gives no inclusion criteria for the 37 incidents, no description of how the taxonomy was validated as complete, and no methodology for the survey. The claim could be an artifact of an incomplete taxonomy or an unrepresentative survey, so it is not supportable from the information provided.","section":"Abstract, 'four types of security risks are overlooked'"}],"minor_comments":[{"comment":"The title and abstract describe a smart contract upgrade security study, but the full text is an unrelated video-game fuzzing paper; the submission must be corrected to contain the work described.","section":"Title and Abstract"},{"comment":"The novelty claims would benefit from explicit comparison with prior works on upgrade-behavior datasets and upgrade-risk taxonomies; the abstract currently asserts novelty without positioning against existing literature.","section":"Abstract, 'first large-scale dataset' and 'first complete view'"}],"recommendation":"reject","confidential_remarks":"The mismatch between the abstract and the full text is so complete that this appears to be a submission or upload error rather than a normal content problem. As submitted, however, the paper cannot be reviewed: the body is a different paper entirely, and the abstract's claims have no supporting methodology. I recommend rejection, with the note that the authors might resubmit the correct manuscript if this was a clerical mistake."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The abstract for arXiv:2508.02145 describes a large-scale study of security risks in smart contract upgrades: 83,085 upgraded contracts, 20,902 upgrade chains, a taxonomy of eight risk types derived from 37 incidents, an awareness survey, and a detection pass that finds 31,407 issues. The supplied full text, however, is the BiFuzz video-game fuzzing paper, which has nothing to do with smart contracts. So I can only comment on the abstract, not the actual manuscript.\n\nWhat looks genuinely new: the claim to the first large-scale dataset of upgrade behaviors and the first complete taxonomy of upgrade-related insecurities. If those priority claims hold, this is a useful contribution to a practically important area. The abstract gives concrete numbers, which is better than hand-waving. The pipeline—build dataset, derive taxonomy from known incidents, survey public awareness, then detect issues—is a sensible structure.\n\nThe soft spots are all about audibility. The abstract gives no methodology: no definition of what counts as an upgrade chain, no explanation of how the 37 incidents were selected, no details on the detection rules, and no precision/recall numbers. The 31,407 figure is uninterpretable without knowing whether it counts unique contracts, issue instances, or something else. The claim that four risk types are “overlooked by the public and lack mitigation measures” depends on a survey that isn't described. None of this is fatal if the full paper fills those gaps, but from the abstract alone the central empirical claims are not verifiable.\n\nI want to be clear that the full-text mismatch is almost certainly an artifact of the review pipeline, not a flaw in the paper itself. Still, it means I cannot attest to the soundness of the data or the completeness of the taxonomy. My guess is that the paper, if it exists as the abstract describes, would be worth a serious referee: the topic is timely, the scale is substantial, and the claimed taxonomy could be genuinely useful for auditors and tool builders. But the referee would need to see the actual dataset and detection logic.\n\nRecommendation: if you can get the real manuscript, send it to peer review. The abstract is enough to justify a look, but not enough to accept any of the empirical claims on faith.","headline":"The abstract is a promising empirical study of smart contract upgrade risks, but the supplied full text is an unrelated fuzzing paper, so none of the headline numbers can be audited from what I have.","tokens_in":5179,"tokens_out":2062,"would_cite":false,"duration_ms":25678,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Smart contract upgrades carry eight security risk types, four of them overlooked by the public and lacking mitigation measures, with 31,407 related issues detected in a preliminary scan.","keywords":["smart contract upgrades","upgrade risks","blockchain security","security taxonomy","security incidents","upgrade chains","public awareness","vulnerability detection"],"falsifier":"An independent reproduction of the detection scan on the same or a comparable set of upgraded contracts would refute the prevalence claim if it found far fewer than 31,407 valid issues; a systematic review of public documentation, audit reports, and existing security tools that shows the four supposedly overlooked risk types already have published mitigations would refute the 'overlooked' claim.","tokens_in":4264,"feed_emoji":"⚠️","tokens_out":5417,"duration_ms":57125,"temperature":0.7,"pith_summary":"Upgrading a smart contract lets developers fix bugs and add features, but it breaks the immutability that many users rely on. This paper argues that upgrade behaviors create security risks that are more varied and less understood than previous work suggests. The authors build what they describe as the first large-scale dataset of upgrade behavior, covering 83,085 upgraded contracts and 20,902 upgrade chains, and from 37 real-world incidents they derive a taxonomy of eight upgrade-risk types. Their survey of public disclosures and mitigation options finds that four of those eight types are overlooked: they appear nowhere in public guidance and have no mitigation measures. A preliminary scan for just those four types identifies 31,407 issues, which the paper takes as evidence that the overlooked risks are common in practice.","feed_headline":"31,407 upgrade risks lurk in smart contracts","feed_subtitle":"First large-scale study finds eight upgrade risk types, four still unmitigated.","key_machinery":"The argument is carried by a dataset of 83,085 upgraded contracts and 20,902 upgrade chains, the first large-scale collection of upgrade behaviors according to the paper, and by an eight-type taxonomy of upgrade risks built from 37 security incidents. The dataset supplies the scale that lets the authors find upgrade behaviors earlier work missed, while the taxonomy converts those behaviors into named risk categories that drive the public-awareness survey. The 31,407 figure comes from a preliminary automated detection scan targeting the four overlooked risk types, so that scan is the empirical step that connects the taxonomy to the claim of widespread risk.","core_discovery":"The central claim is that a smart contract upgrade is not a single event but a chain of behaviors, and that these behaviors carry at least eight distinguishable security risk types. The paper develops an eight-type taxonomy from 37 real-world incidents and asserts that it is the first complete view of upgrade-related insecurities. It then finds, through a survey of public awareness, that four of the eight types are absent from public discussion and lack mitigation. The paper ties the taxonomy to prevalence by running a preliminary detection of those four types across its dataset and reporting 31,407 related issues. In the authors' telling, this shows that the 'dark side' of upgrades is not hypothetical: overlooked upgrade risks are present at scale on deployed contracts.","pith_inferences":["Because the abstract reports a preliminary scan without validation details, the 31,407 count is best read as an upper bound; a random-sample audit of flagged contracts would test how many are genuine vulnerabilities rather than false positives.","If the four overlooked risk types truly lack mitigations, existing smart contract security standards were designed around single immutable contracts; updating those standards might close the gap faster than patching individual contracts.","The upgrade-chain dataset could support other studies, such as measuring how quickly contracts patch known bugs after an incident, or correlating upgrade frequency with exploit likelihood."],"forward_implications":["Security audits of smart contracts would need to treat upgrade mechanics as an independent risk category, checking not just the current code but the whole upgrade history and chain.","If the taxonomy is adopted, platforms and regulators would have a shared vocabulary for requiring disclosure of upgrade behavior, since current public channels miss four risk types entirely.","Developers of upgrade frameworks would need to add built-in safeguards for the four unmitigated risk types, which today have no mitigation measure.","The 31,407 detected issues imply that remediation efforts should extend to already-deployed contracts, not only newly written ones.","The dataset of upgrade chains could serve as a baseline for future tools that scan for upgrade-chain-level vulnerabilities instead of single-contract snapshots."],"supporting_citations":[],"fun_headline_variants":["31,407 upgrade risks found in smart contracts","Eight upgrade risk types, four without fixes","Upgrade chains expose 31k security issues","Smart contract upgrades: 8 risks, 31k findings","First large-scale study of upgrade risks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central claim rests on the dataset correctly identifying which contracts were upgraded and how their upgrade chains connect, and on the eight-type taxonomy being complete enough that the four 'overlooked' types are genuinely missing from public knowledge rather than missing from the authors' search.","fun_headline_variants_meta":{"raw":{"variants":["31,407 upgrade risks found in smart contracts","Eight upgrade risk types, four without fixes","Upgrade chains expose 31k security issues","Smart contract upgrades: 8 risks, 31k findings","First large-scale study of upgrade risks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000262,"raw_usage":{"total_tokens":1563,"prompt_tokens":879,"completion_tokens":684,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":495,"completion_tokens_details":{"reasoning_tokens":613}},"tokens_in":495,"tokens_out":684,"duration_ms":8285,"temperature":1.0,"reasoning_tokens":613,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T05:07:18.622397+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An independent reproduction of the detection scan on the same or a comparable set of upgraded contracts would refute the prevalence claim if it found far fewer than 31,407 valid issues; a systematic review of public documentation, audit reports, and existing security tools that shows the four supposedly overlooked risk types already have published mitigations would refute the 'overlooked' claim.","supporting_citations":[],"review_version":1}