Usage of SafeERC20 makes contract not upgrade-safe

SafeERC20 from the Openzepelin contracts is a very popular Lib. However, using it in an upgradable contracts makes them non upgrade-safe according to the plugin.

More specifically, the following error is thrown

Error: Contract `Contract` is not upgrade safe
@openzeppelin/contracts/utils/Address.sol:185: Use of delegatecall is not allowed
    https://zpl.in/upgrades/error-002

At the moment I’m ignoring that error by setting

unsafeAllow: ['delegatecall']

However, this is unclear whether it will cause issues or not.

Would it be possible to clarify this point. SafeERC20 is a very popular lib so I believe many users will experience this issue.

[Amxx]

Hello @ppoliani

SafeERC20, found in the @openzeppelin/contracts repository, does depend on Address, which contains non-upgrade-safe functions. Due to current limitations, we are not able to clearly identity which function in library are called, and if they are upgrade-safe… Thus making the SafeERC20 flagged as potentially upgrade-unsafe.

A good option for you would be to use SafeERC20Upgradeable from the @openzeppelin/contracts-upgradeable repository. This version depends on AddressUpgradeable which is upgrade-safe.

[frangio]

@jmendiola222 Issue https://github.com/OpenZeppelin/openzeppelin-upgrades/issues/240 is what would fix this problem.