### Upgrade Pattern
The OclTokenizer contracts use the **UUPS (Universal Upgradeable Proxy Standard)** pattern:
* Proxy contracts hold state and delegate calls to implementation contracts
* Only the contract owner can authorize upgrades
* Contract addresses remain stable across upgrades
### IP Token Cloning
IP Tokens (IPTs) are deployed using the **EIP-1167 Minimal Proxy** pattern:
* Each Lab tokenization creates a new `LabToken` clone
* Clones share implementation code but have independent state
* No fixed deployment address - each IPT has a unique address
* Query `OclTokenizer.tokenized(labId)` or use the indexer to find IPT addresses
### Security Considerations
* Legacy core contracts (IPNFT, CrowdSale, TimelockedToken) have been audited by pashov
* The Molecule Labs core (OnChainLab account stack) was audited by Cyfrin in 2026 — see [Audits](/security/audits.md)
* Admin functions are protected by `onlyOwner` access control
* See individual contract pages for specific security notes
### Related
* [Architecture](/technical-deep-dive/architecture.md) — how the Lab contracts fit together
* [Audits](/security/audits.md) — audit reports
* [Tokenization API](/api-reference/tokenization-api.md) — tokenizing a Lab through the API
{% hint style="info" %}
**Need help?**
Ask the team on Discord. Reporting an API error? Include the `requestId` from the failing response so we can trace it.
Ask on Discord
*Page wrong, unclear or missing something? Let us know with **Was this helpful?** on this page.*
{% endhint %}