Upgradeable Contract

An upgradeable contract keeps its address and its stored balances while the logic behind it can be replaced, usually through a proxy that forwards calls to an implementation address an administrator is able to change. It lets a team fix bugs without asking every user to migrate, and it also means the code audited today is not necessarily the code running tomorrow. The safety question is therefore who can trigger an upgrade and after what delay: a single key that can swap the implementation instantly is a very different risk from a multisig sitting behind a timelock that publishes the change in advance.