Protocol Upgrade Compatibility Review: PancakeSwap AMM

The Protocol Upgrade Compatibility Review for PancakeSwap's AMM, dated 2 October 2026, was conducted by a Senior DeFi Security Researcher and Smart-Contract Auditor. The review assessed the technical design and compatibility of the PancakeSwap AMM contracts, which are deployed on Ethereum and various L2 roll-ups such as Arbitrum, Optimism, and zkSync.

The AMM is a critical component of PancakeSwap, responsible for liquidity provision and swapping, and has been in use on BSC for years. The migration to Ethereum and L2s introduced a new upgradeability stack using Transparent/Universal Upgradeable Proxy (UUPS) and OpenZeppelin v5 libraries, along with a cross-chain governance framework.

The review focused on several key areas, including the proxy pattern and storage layout, governance and timelock, cross-chain upgrade orchestration, testing and formal verification, emergency pause and circuit-breaker, dependency management, and upgrade-only access to critical functions. The findings revealed several compatibility and governance weaknesses in the upgrade framework, including the risk of storage collision when adding new state variables, the potential for proxy admin hijacking, and the absence of replay-protection in the upgrade proposal broadcasting process.

Additionally, the review noted that the mix of OpenZeppelin v4 and v5 libraries could lead to inconsistent ABI and potential delegate-call mismatches, and that the pause() function in the contract is only callable by the DAO timelock, which could become inaccessible in an upgrade scenario.

The overall risk score for upgrade compatibility was determined to be 7 out of 10, indicating a high-mediocre level of risk. The review concluded with prioritized technical recommendations to address the identified weaknesses, such as adopting a uniform upgrade pattern across all chains, introducing explicit storage gap and versioning guarantees, hard-enforcing proxiableUUID checks in the DAO timelock's executeUpgrade function, adding an upgrade nonce and replay protection in the Bridge-Relay contract, and implementing upgrade test coverage for edge-case storage migrations.