issue of upgradable contract code

[bezalel]

After reading 'setcode'-related source codes of EOSIO, I found that the contract code set to an account can be modified anytime if the owner of the contract account makes a new 'setcode' transaction. Before reading EOSIO source, I thought that deployed contract code could only be modified after getting the confirmation of block producers. (in the case of security bugs, I thought BPs freeze and upgrade a contract) If modification of contract code is possible anytime, I think malicious dapp developers or hackers can steal user's asset by suddenly modifying contract code. This will cause disasters and more powerful FUD to the EOS ecosystem.

Below are the possible cases of disaster caused by upgradable contract code,

• Recent airdrop tokens are implemented on their own account with their custom token contract code, anytime the airdrop token contract owner or hacker who stole the ownership of the token contract can maliciously steal or ruin the token by modifying code suddenly.
• A DEX contract code holding the user's assets deposited to the DEX contract account can be modified suddenly by the malicious DEX Dapp developers or hackers, and the deposited user's asset can be stolen.
• ...

Don't we need more security features for 'setcode' transaction?

[humblefirm]

I agree that

[Lucklyric]

I also agree with that. I also would like to know is there any way can prevent this happens?

[bezalel]

To mitigate this issue, Dapp developers can voluntarily use multisig or set owner to eosio.prods (Dan's quick opinion to my private message)

Though Dapp devs can set their contract account to be owned by producers voluntarily to get trust from users, but that's not required(compelled). If setting "eos.prods" should be the best practice of Dapp contracts, then community should overwatch which contract is owned by producers or multisig-ed and which is not, and warn the risk of not-producer-owned contracts.

And, once the contract is owned by producers, the Dapp devs cannot do other neccessary transactions like selling unused ram(though ram can be bought by others), and so on, by themselves.