Protocol Upgrade Compatibility Review: Bybit

Bybit, formerly a centralized derivatives exchange, has transformed into a multi-chain DeFi hub with spot trading, perpetuals, lending, staking, and L2-native products. This expansion required numerous on-chain upgrades, including proxy migrations, new module deployments, bridge extensions, and governance changes. This report examines the technical soundness of these upgrades and the risks associated with the interaction of legacy contracts with new modules.

The assessment covers contract architecture, proxy patterns, governance and access control, cross-chain bridges, core financial modules, oracle feeds, and the upgrade process. The findings reveal seven key issues, including storage-slot collisions, inconsistent initializer protection, governance bypass, L2 bridge replay attacks, oracle manipulation, insufficient testing, and global pause abuse.

While the upgrade framework functions, these flaws could be exploited by determined attackers, particularly during high-value governance actions or L2 bridge migrations. The report recommends introducing storage gaps, fixing initializer protection, correcting governance bypass, mitigating bridge replay attacks, enhancing oracle fallback mechanisms, improving upgrade testing, and refining emergency pause granularity.