An Upgraded(address) event tells you that the code behind a proxy changed, not what changed. Ledgerbell Pro follows every upgrade alert with a short report:
Verification status of the old and new implementation (Sourcify, with Blockscout as fallback). An unverified new implementation is flagged.
Functions added and removed (with 4-byte selectors) and state-mutability changes.
Events added and removed.
Source files added, removed or modified (by metadata hash), compiler and contract-name changes.
Flags for sensitive new functions (upgrade, initialize, ownership, roles, mint, withdraw, sweep, arbitrary call…).
The report is a diff of public metadata, not a security review.
Setup
Add a contract watch on the proxy address (any EIP-1967 proxy: UUPS, transparent, or beacon). Ledgerbell records the current implementation when you add it, so the first upgrade already has a baseline.