Let's say we have a
ContractV1 its implementation, using the UUPS pattern. Along that, there is a DAO that has the rights to perform an update on the implementation contract. Only the DAO is able to do so. Now, the developers of
ContractV1 have found a critical bug, which could disrupt
ContractV1 and allows users funds to be stolen for example. The bug is not public yet and has not be used by any attacker. The developers team then develop
ContractV2 which fixes the bug, and then deploys it and propose to the DAO to update the implementation.
The problem now is that the DAO would need to see the new implementation code before voting to implement it to be sure their is not problem with it, thus revealing what the dev team fixed and eventually allowing bad actors to use this now known bug to their advantage before
ContractV2 is chosen as the new implementation.
My question is, how to solve this problem?
I only have found two solutions for now, neither of them entirely satisfying:
ContractV2but do not verify the code. It requires the DAO to trust the dev team. Eventually some selected external members could be asked to check the code and vouch for the dev team if they do not find any issues
ContractV1until the implementation is updated, then deploy and verify
ContractV2code for the DAO to see. The downside is of course that the application becomes unusable during all the vote duration.
Is there a solution that could ensure the security of the application (not revealing the bug before it is actually fixed) while remaining trustless and without impacting its availability?