From what I understand, for UUPS proxies: the proxy contract is ERC1967Proxy.sol from OpenZeppelin Contracts and the implementation contract should inherit from UUPSUpgradeable.sol in OpenZeppelin Contracts-Upgradeable

But it seems like a malicious actor could easily initialize the the implementation before the deployer. I'd like to initialize the admin in the constructor of the proxy contract. It seems like I can use the admin slot: 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 and then permission the initialize function to the admin — would this be safe? Why isn't it set this way by default?

1 Answer 1


This is the constructor for ERC1967Proxy.sol:

constructor(address _logic, bytes memory _data) payable {
     _upgradeToAndCall(_logic, _data, false);

The _data param is an optional encoded call to the implementation/logic contract where you can call the initializer function atomically on deployment (or make any arbitrary call to the logic contract)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.