Smart Contract Upgrade Bugs: What 52 Update Reviews Found
Quick answer. In Guardian's published portfolio, 11 of 52 update reviews (21%) found a Critical and 29 (56%) a Critical or High. That is fewer than initial audits (41% and 64%), but updates are about half the size.
Video transcript
After launch, every change ships into a system that already holds deposits. Guardian's published audit portfolio shows how often those changes still carry Critical bugs.
Eleven of fifty two update reviews, 21 percent, reported at least one Critical. Together they held 21 Criticals and 83 Highs.
Updates are about half as likely as first audits to hold a Critical. But more than half still had a Critical or High, close to the overall onchain rate.
Twenty three update reviews had twelve or fewer findings. Seven of them still had a Critical or High.
Most were logic errors. Changed units double counted shares. A new feature could block liquidations. A volatile asset met old pricing. And a check existed but was never applied.
Fixes are changes too. Remediation rounds in 125 reports surfaced 18 Criticals and 119 Highs.
Review every change that touches value flow. Diff against the audited commit. Recheck units and decimals. Test liquidation and gas limits, and rerun the invariant suite.
Guardian's Vanguard audit includes six months of update review after production, at the same standard as the audit.
Read the full report, or talk to Guardian about keeping every update covered at guardian.security.
Smart contract upgrade bugs are easy to overlook. Yet after launch, every change ships into a system that already holds deposits.
This report measures what reviews of those changes found. It compares update reviews in Guardian's public audit portfolio with first audits and with fix reviews.
It is the second of three reports on the same data, after What 360 Critical Bugs Taught Us. The third covers offchain pentest findings.
Update Reviews in the Sample
The dataset is Guardian's published reports as of November 4, 2026: 337 reports and 10,086 findings. We compared the 332 reports the portfolio files as onchain work (9,894 findings).
We grouped them by what each report's title says:
- Update reviews (52): the title contains Update, Updates or Upgrade.
- Fix and follow-up reviews (5): the title names a fix, mitigation, remediation or follow-up.
- Initial audits (98): the client's first published onchain report, if in neither group above.
- Other reports (177): everything else, such as new modules, later rounds and deployment reviews.
51 of the 52 update reviews follow an earlier published report for the same client. They cover 21 clients, led by GMX (14), Magna (6), USDT0 (5) and Abracadabra Money (4).
Limitations. The portfolio does not record whether code was live when it was reviewed, or which lines changed. So titles are a proxy.
Some update reviews may cover changes made before a launch, and some reports in the Other group are really updates under another name.
We cannot tell whether each finding sat in the changed lines or in code the change touched. And these are published reports only.
Critical and High Rate per Review
| Group | Reports | Critical / High | With a Critical | With a Critical or High | Critical or High share of findings | Median findings |
|---|---|---|---|---|---|---|
| Update reviews | 52 | 21 / 83 | 21.2% | 55.8% | 9.8% | 14.5 |
| Fix and follow-up reviews | 5 | 0 / 16 | 0% | 20.0% | 9.6% | 9 |
| Initial audits | 98 | 162 / 389 | 40.8% | 64.3% | 14.2% | 30.5 |
| Other reports | 177 | 177 / 393 | 26.0% | 53.7% | 11.9% | 19 |
| All onchain reports | 332 | 360 / 881 | 29.2% | 56.6% | 12.5% | 21 |
Together, the 52 update reviews held 21 Criticals and 83 Highs.
An update review is about half as likely as an initial audit to find a Critical.
But more than half of update reviews still found a Critical or High. That is almost exactly the rate for onchain reports overall (55.8% against 56.6%).
Updates are smaller, with a median of 14.5 findings against 30.5. Yet 9.8% of their findings are Critical or High, about two thirds of the initial-audit share (14.2%).
The pattern holds without GMX, which has the most update reviews.
Excluding it, 6 of 38 update reviews (15.8%) contain a Critical and 22 (57.9%) a Critical or High, against 40.2% and 63.9% for initial audits.
Small changes, big bugs
The size of a diff is a poor guide to its risk.
23 of the 52 update reviews reported 12 or fewer findings, and seven of those still contained a Critical or High.
The single finding in GMX's June 2024 Part 3 review is a Critical. The 12-finding MIMSwap Updates review held five.
Fixes Produce Findings Too
125 onchain reports record at least one remediation round, in which Guardian reviews the team's fixes.
1,424 findings were first reported during those rounds, including 18 Criticals and 119 Highs.
41 of the 125 reports (32.8%) gained a Critical or High during a remediation round, and 10 gained a Critical.
Some are fixes that did not close the original issue. Others are new problems in the changed code.
In Synthetix's Update Reviews, for example, the withdrawal request function no longer had access control.
Since a user can have only one withdrawal at a time, anyone could open a 1 wei withdrawal for any user and block them indefinitely.
Bug Types in Updates
By label, update Criticals and Highs look like those in initial audits, only more concentrated in logic. Logical Error is 62.5% (initial audits 50.6%) and DoS 15.4% (14.9%).
The descriptions show the usual pattern: an assumption the original code made, quietly broken by the change.
The units changed
In Bracket's Contract Updates (C-02), a token's internal transfer function was updated to convert amounts to shares.
The vault already passed share amounts, so mints and burns were converted twice.
A new feature reached the liquidation path
In GMX's Synthetics Updates, June 2024, Part 1 (C-02), a new auto-cancel feature cleared a position's stop-loss and take-profit orders when it closed. A liquidation always closes it.
With up to 10 such orders, each with callback gas, a liquidation could need more than 31 million gas. That is above Avalanche's block gas limit.
A new asset type met old pricing
In Abracadabra Money's MIMSwap Updates (C-04), an update meant to support volatile assets kept a guiding price with no external oracle.
As a volatile token's price moved, traders could take it from the pool below market.
A check existed but was not applied
In Magna's Hook Updates (C-01), the contract kept a whitelist of post-claim handlers but never checked it on withdrawal.
Anyone could set their own handler and claim directly when direct claims were meant to be blocked.
Building an Update Review Cadence
What the data suggests for teams that ship after launch:
- Review every change that touches value flow, permissions, pricing or liquidation, whatever its size.
- Diff against the audited commit, not the last release, and read the code around the change.
- Hunt for removed or unused checks. Both produced Criticals above.
- Re-check units and decimals at every changed boundary: shares against assets, 6 against 9 or 18 decimals.
- Test new features against liquidation, withdrawal and gas limits.
- Re-run the invariant suite on every change, and add invariants for what it introduces.
- Review the fixes too. A fix is a change like any other.
- Watch what ships. Pair reviews with monitoring of deployments and admin actions.
How Guardian Reviews Updates
Vanguard, Guardian's flagship audit, includes six months of update review after production. Every change to the audited scope is reviewed at the same standard as the audit.
That covers up to 2,500 smart contract SLOC or 10,000 SLOC for offchain codebases, split however the team ships.
The invariant suite Guardian builds during the audit stays with the team as a reusable harness for fixes, retesting and every later change.
Guardian's audits also cover upgrades on their own: migrations, parameter changes, governance updates and hot fixes.
GMX is the longest example: Guardian has reviewed every smart contract update GMX has shipped since October 2022, as its client story describes.
Frequently Asked Questions
How often do updates to an audited protocol contain Critical bugs?
In Guardian's published portfolio, 11 of 52 update reviews (21%) reported at least one Critical and 29 (56%) a Critical or High. For initial audits, the rates are 41% and 64%.
Are small smart contract updates safe to ship without review?
The data says no. Of the 23 update reviews with 12 or fewer findings, 7 still had a Critical or High.
Do fixes for audit findings introduce new bugs?
Sometimes: remediation rounds in 125 published onchain reports surfaced 1,424 new findings, including 18 Criticals and 119 Highs. Some are incomplete fixes; others are new problems in the changed code.
What kinds of bugs do upgrades introduce?
In update reviews, 62.5% of Criticals and Highs are labeled Logical Error and 15.4% DoS. Examples include double-converted shares, a feature that could block liquidations, old pricing for a volatile asset and an unchecked whitelist.
Sources
- Guardian: Public audit portfolio, 337 reports and 10,086 findings (as of November 4, 2026)
- Guardian: Synthetix Update Reviews (December 1, 2025)
- Guardian: Bracket Contract Updates (September 24, 2025)
- Guardian: GMX Synthetics Updates, June 2024, Part 1 (June 14, 2024)
- Guardian: GMX Synthetics Updates, June 2024, Part 3 (June 14, 2024)
- Guardian: Abracadabra Money MIMSwap Updates (January 24, 2025)
- Guardian: Magna Hook Updates (October 31, 2024)
- Guardian: Vanguard, including six months of update review
- Guardian: GMX client story
Keep every update covered
Vanguard reviews every change to your audited scope for six months after production, at the same standard as the audit.