OpenZeppelin / OpenZeppelin/openzeppelin-foundry-upgrades

Validation incorrectly flags `ReentrancyGuard` as unsafe in OpenZeppelin v5.5+

Open
#116 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Solidity
Stars
258
Forks
42
PR merge metrics
No merged PRs in 30d

Description

Validation fails when using ReentrancyGuard from @openzeppelin/contracts in upgradeable contracts.

Error:

Contract `ReentrancyGuard` has a constructor
Define an initializer instead
https://zpl.in/upgrades/error-001

OpenZeppelin v5.5.0-rc.0 marked ReentrancyGuard as stateless and recommends importing from @openzeppelin/contracts (not -upgradeable):
https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.5.0-rc.0

"ReentrancyGuard and ReentrancyGuardTransient are flagged as stateless and are no longer transpiled. Developers must update their imports to use the equivalent version available in @openzeppelin/contracts."

Current workaround:

opts.unsafeAllow = "constructor";

Validator should recognize @custom:stateless contracts from OZ v5.5+ as safe.

Affected contracts:

  • ReentrancyGuard
  • ReentrancyGuardTransient
  • ERC721Holder
  • ERC1155Holder

Environment:

  • openzeppelin-foundry-upgrades: v0.4.0
  • openzeppelin-contracts: v5.5.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the validator logic that reports constructors as unsafe, then trace how it handles OpenZeppelin contracts and the @custom:stateless annotation. Verify the affected ReentrancyGuard, ReentrancyGuardTransient, ERC721Holder, and ERC1155Holder contracts are accepted without unsafeAllow="constructor", and add or update validation coverage if the project has it.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.