can a developer delete balances trough a contract update using openzeppelin

Question

I am new to this and just have some arbitrary questions regarding upgradeable smart contracts.

If a Developer would update his contract, could he modify all mappings / variables entirely? Wipe balances, reset values?

Answer 1

If a Developer would update his contract

That's a bit vague, but let's assume you mean

1. the developer is a single EOA which is the sole admin for upgrades
2. the upgrades follow the proxy upgradable pattern, simply changing the implementation contract which calls are forwarded to via delegatecall.

In this scenario, technically the balances cannot be deleted, but effectively they can. What I mean by that is you cannot change the storage of a contract via updates since the proxy contract itself contains the storage. And we never change the proxy in upgrades.

But since you can change the logic however you like, you can effectively do whatever you want. For example in an ERC-20, you could just create a new balances mapping;

contract TokenContractV2 {
    // old data in proxy
    mapping (address => uint256) private _balances;
    mapping (address => mapping (address => uint256)) private _allowances;
    uint256 private _totalSupply;

    // new data
    mapping (address => uint256) private _newBalances;

    function transfer(address recipient, uint256 amount) external returns(uint) {
        _newBalances[msg.sender] = _newBalances[msg.sender].sub(amount);
        _newBalances[recipient] = _newBalances[recipient].add(amount);

        return true;
    }
}

This is an incomplete example, but it gets the point across.