> For the complete documentation index, see [llms.txt](https://gabriel-j-shapiro.gitbook.io/metalex-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gabriel-j-shapiro.gitbook.io/metalex-docs/protocol-explanation/co-approval-upgradeability.md).

# Co-approval upgradeability

Upgradeable contracts are a power-concentration risk. The wrong upgrade key on a stock-ledger contract is, functionally, the wrong signature on a board resolution. cyberCORPs solves this with a **co-approval** model: neither MetaLeX nor any individual issuer can unilaterally upgrade a deployed cyberCORP.

## How it works

Each cyberCORP's top-level contracts (`CyberCorp`, `IssuanceManager`, `DealManager`, `RoundManager` in v3) are UUPS-upgradeable proxies. The `upgradeToAndCall(impl, data)` function is gated on **two** invariants:

1. `impl` must be a MetaLeX-published reference implementation (tracked on the relevant factory via `setRefImplementation` / variants).
2. The caller must hold the issuer's `UPGRADE_AUTHORITY` BorgAuth role.

Neither condition is sufficient alone:

* MetaLeX publishing a new implementation does *not* upgrade anyone. The factory's reference is just a published address.
* An issuer attempting to upgrade to an arbitrary implementation will revert. The implementation must be on the factory's allow-list.

## What this buys you

* **No forced migrations.** A cyberCORP that wants to stay on its current implementation can do so indefinitely.
* **No MetaLeX admin keys over your stock ledger.** MetaLeX is a protocol developer and steward, not a securities intermediary.
* **No issuer escape to a malicious implementation.** Issuers cannot dodge protocol invariants by upgrading to a fork.

## Beacons for downstream instances

`CyberCertPrinter` and `CyberScrip` instances use beacon proxies pointing at beacons **owned by the IssuanceManager itself**. When the IssuanceManager's officer upgrades the beacon, every printer/scrip instance under that IssuanceManager moves together — which is what you usually want, since they share storage layout and behavioural assumptions.

The same co-approval invariant applies: the beacon will only accept implementations registered on the factory.

## Legacy paths

Legacy cyberCORPs deployed before v3 use top-level beacon proxies pointing at MetaLeX-owned beacons. They continue to receive upgrades via the beacon pattern (which is more MetaLeX-controlled), but the underlying invariant — co-approval — is preserved at the implementation-publication step. Legacy deployments can migrate to v3 in place via the `*WithMigration.sol` variants.

## See also

* [Upgrade model](/metalex-docs/protocol-reference/upgrade-model.md)
* [How-to: Upgrade a cyberCORP](/metalex-docs/protocol-how-to-guides/upgrade-a-cybercorp.md)
* [The role of MetaLeX](/metalex-docs/protocol-explanation/role-of-metalex.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://gabriel-j-shapiro.gitbook.io/metalex-docs/protocol-explanation/co-approval-upgradeability.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.