Smart Contract Upgrades Under Attack: OWASP SC10 Formalizes the Proxy Vulnerability Crisis

The OWASP Smart Contract Top 10 now formally recognizes proxy vulnerabilities as a critical security category (SC10), driven by over $200M in DeFi losses during 2025-2026 and the fact that 54% of Ethereum contracts use upgradeable proxies. Automated bot attacks now hunt uninitialized proxies across EVM chains within minutes of deployment, placing existing projects at immediate risk. Protocols must now implement specialized defenses against storage collision and initialization flaws, marking a fundamental shift in how smart contract security is architected.