The Hidden Dangers of God Mode in Smart Contracts

Decentralized blockchain applications, including DeFi, promise a world where code is law and users trust transparent, immutable smart contracts rather than centralized intermediaries. In this article, while acknowledging the value of upgradeability, we explore whether an unsettling practice has emerged: secretly using a “God Mode” to manipulate the smart contract state and reverse undesirable events. We highlight the importance of accountability, transparency, and security in maintaining trust within decentralized systems.

What Is ‘God Mode’ in Smart Contracts?

The term “God Mode” has been previously used to describe admin keys that grant developers control over smart contracts. However, this article focuses on “God Mode” as the ability to manipulate smart contract states in obscure and risky ways. “God Mode” here refers to the ability of developers to manipulate the storage directly, bypassing the intended transparent and immutable nature of blockchain code. Dev teams can achieve this through upgradeable contracts and privileged keys that potentially allow to:

• Revert malicious transactions
• Restore stolen funds
• Correct unintended liquidations due to faulty oracles

While these actions seem beneficial on the surface, they raise significant concerns about decentralization and user trust.

How Is ‘God Mode’ Even Possible in Smart Contracts?

Smart contracts were conceived and often perceived as immutable pieces of code that, once deployed, don’t change. However, in practice, developers implement mechanisms to modify the logic of smart contracts or their state after deployment.

Upgradeable Contracts

One typical implementation of mutable smart contracts is upgradeable contracts. Instead of deploying a single, immutable contract, developers use a proxy pattern where:

• Proxy Contract: This contract remains at a fixed address, and delegates calls to an implementation contract.
• Implementation Contract: Contains the actual logic and can be swapped out for a new version.

Developers can change the implementation contract by updating its address in the proxy.

While upgradeability can help fix bugs or add features, it can increase risk if developers and admins don’t follow smart contract security best practices.

For a deeper dive into secure upgradeable contracts, see our article on the topic

Direct Storage Manipulation

Smart contracts can expose functions that directly alter the contract’s storage. Developers could justify this functionality in the context of their application business logic, such as by using a custom, simplistic upgrade mechanism. However, when implemented, the functionality could be more permissive than anticipated.

God Mode State Modification Step by Step

This process describes how developers with admin access could potentially make significant changes to a smart contract system quickly and with minimal visibility, this is what we call “God Mode”.

1. Admin Access: Developers maintain upgrade rights to the proxy contract.

2. Preparation:

   • Create a new, private implementation contract with special functions for desired state modifications.

3. Swift Execution:

   • Upgrade the proxy to point to the new implementation.

   • Execute the special functions to make necessary changes.

   • Immediately revert the proxy to the original (or new stable) implementation.

4. Minimizing Visibility:

   • Perform all actions in as few transactions as possible, ideally just one.
   • The brevity of the upgrade makes it less likely to be noticed.

When Might ‘God Mode’ Be Used?

Developers may use “God Mode” in specific situations where immediate intervention is necessary. While concrete instances are hard to confirm due to the lack of transparency and special tools, understanding possible scenarios sheds light on the risks involved.

Possible Scenarios:

1. Stolen Tokens Remaining Within the Contract
   • Situation: An exploit manipulates token balances inside the contract without transferring them out because the contract manages the token ledger.
   • Developer Response: Use “God Mode” to adjust internal balances, effectively reversing the unauthorized changes.
   • Impact on Users: Users might remain unaware that their balances were compromised and corrected internally.
2. Erroneous DeFi Liquidations Tracked On-Chain
   • Situation: A faulty oracle or bug triggers unintended liquidations of user positions in a DeFi platform.
   • Developer Response: Modify the contract state to restore users’ collateral or reverse liquidations.
   • Impact on Users: Affected users may not realize their positions were liquidated and reinstated unless informed.
3. On-Chain Vulnerabilities and Inconsistencies
   • Situation: Attackers exploit a vulnerability, causing inconsistent states or unauthorized actions within the contract.
   • Developer Response: Before fixing the root cause, developers might use “God Mode” to revert malicious transactions or correct the state.
   • Impact on Users: Swift, undisclosed interventions prevent further issues but lack transparency.

Security Impact

While using “God Mode” to modify a smart contract’s state might be tempting to silently solve critical issues, it introduces significant security risks:

• Storage Layout: Any modifications must carefully consider the storage layout of the contract. Storage layout challenges are discussed in our upgradeable smart contracts article.

• Opacity: The unverified (i.e., source code uploaded to explorers) contract and quick execution make it difficult for outside observers to detect and understand the changes.

• Trust Concerns: While potentially useful for emergency fixes, this process represents a high degree of centralized control, lacks transparency, and could erode trust if discovered.

Detection and Accountability

The potential for “God Mode” interventions in smart contracts highlights the need for better transparency tools in the DeFi space. While mechanisms like admin roles and upgradeability provide the necessary flexibility, they must be balanced with accountability to uphold the principles of decentralization.

Detection Challenges

• External observers only see interactions with the proxy contract.
• The brief window of the upgraded implementation makes real-time detection unlikely.
• Without source code, understanding the nature of changes is extremely difficult.

For an example of how smart contract attackers accomplish direct storage manipulation, read Coinspect’s Learn EVM Attacks analysis of the Tornado Cash Governance attack.

Conclusion: We Need More Accountability Tools

‘God Mode’ shows us both the power and risks of privileged access in smart contract security. While it can be used to address critical issues, it also poses a threat to the principles of decentralization and user trust.

High-quality smart contract audits are required to ensure a strong security foundation in DeFi projects. However, smart contract audits alone are not enough: continuous monitoring, community vigilance, and effective accountability tools are necessary to detect any misuse and maintain the trust that decentralized systems promise.