A proxy upgrade replaces a contract’s entire behaviour while keeping the same address and the same funds.
Contracts are often deployed behind a proxy so bugs can be fixed later. The proxy holds the address, the balance and the storage; the logic lives in a separate implementation contract that the proxy points at.
An upgrade repoints it. Every rule the contract follows can change in one transaction, while the address stays identical and the funds stay put. Audits of the old implementation say nothing about the new one.
This is normal and often responsible — it is how serious protocols ship fixes. But it means "this contract has been audited" and "this contract is safe" are different claims, and that an approval you granted yesterday applies to code that may be replaced tomorrow.
Only the proxy admin can normally do this. If you are being asked to sign an upgrade and you are not the admin of that contract, something is wrong.
Check a transaction of your ownPaste anything. It is decoded in your browser.