UUPS _authorizeUpgrade correctly permissioned

Across Protocol's assessment for RD-F-021 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

SpokePool contracts use UUPS upgradeable pattern. `_authorizeUpgrade(address newImplementation)` is defined in SpokePool.sol as `internal override onlyAdmin {}` where `onlyAdmin` resolves to `_requireAdminSender()` — which requires the caller to be the crossDomainAdmin (the HubPool for all SpokePools). This is confirmed at commit 401e24c. The HubPool itself uses standard Ownable with constructor — not UUPS. SpokePool's upgrade authorization is admin-controlled, not open.

Sources #

URL
OZ V2 audit 2023 (first of 9 engagements)https://www.openzeppelin.com/news/uma-across-v2-audit-2023retrieved 2026-04-26
GitHub
https://github.com/across-protocol/contracts/blob/401e24ccca1b3af919dd521e58acd445297b65b6/contracts/SpokePool.solretrieved 2026-04-28

Methodology #

Determine whether the UUPS implementation defines `_authorizeUpgrade(address)` restricted to owner/admin/timelock (not open to arbitrary callers).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol across-protocol factor RD-F-021 score green collected_at 2026-04-30 21:19:18