# Diamond upgrade proposition can be falsified

Diamond upgrade proposal hash omits _init and _calldata, letting admins execute arbitrary delegatecall code after community review of a benign-looking proposal.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: Czar102
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/241
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-02
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:governance

**Target:** DiamondCutFacet / LibDiamond upgrade proposal hashing
**Root cause:** The proposal id is computed by hashing only the facet cut changes, excluding the _init address and _calldata that are delegatecalled during the upgrade, so the executed payload is not committed to by the reviewed hash.
**Steps:**
1. Submit a diamondCut proposal with benign facet changes; the proposal id hashes only the facet cut array.
2. Community reviews and approves the proposal id after the timelock delay.
3. At execution, supply an arbitrary _init and _calldata; the contract delegatecalls it, performing any action.
4. Because the id does not cover _init/_calldata, the executed payload differs from what was reviewed.
**How found:** Code reading of DiamondCutFacet.diamondCut and LibDiamond: noticed the proposal id hashing covered only facet changes and skipped _init and _calldata, which are delegatecalled.
**Exploitation:** A malicious or compromised admin proposes a benign-looking upgrade, waits out the delay while the community verifies only the facet changes, then executes the upgrade with an attacker-chosen _init/_calldata delegatecall to take arbitrary actions on the contract.
**Insight:** When a timelock/governance hash commits to a proposal, verify every field that affects execution—especially delegatecall targets and calldata—is included in the hash, not just the visible diff.