Anchor Upgrade Security Remediation

Overview

Related Detector: Anchor Upgrade Security

Unprotected upgrade authority is the highest-severity risk for upgradeable programs. The fix is to use multi-sig governance, implement mandatory timelocks, and consider making programs immutable once stable.

Impact. Whoever holds the upgrade authority can replace the program’s entire code in a single transaction, so an unprotected or single-key authority is total control over every account and token the program governs. A compromised upgrade key — phishing, insider, or a leaked secret — becomes an instant, irreversible drain of all user funds, which is why this ranks as the highest-severity risk for an upgradeable program.

Recommended Fix

Before (Vulnerable)

// Single keypair can upgrade at any time
invoke(&bpf_loader_upgradeable::upgrade(...), accounts)?;

After (Fixed)

// Require multi-sig + timelock
require!(multisig.threshold_met(), InsufficientSignatures);
require!(clock.unix_timestamp >= proposal_time + TIMELOCK, TimelockPending);
invoke(&bpf_loader_upgradeable::upgrade(...), accounts)?;

Alternative Mitigations

Use Squads Protocol

Transfer upgrade authority to a Squads multi-sig for decentralized governance:

solana program set-upgrade-authority <PROGRAM_ID> --new-upgrade-authority <SQUADS_VAULT>

Make Immutable

For production programs that should never change:

solana program set-upgrade-authority <PROGRAM_ID> --final

Common Mistakes

Mistake: Short Timelock

const TIMELOCK: i64 = 3600; // 1 hour -- too short for community review

Use timelocks of at least 24-48 hours to allow community review of proposed upgrades.