4 of the 40 biggest DeFi contracts I checked can be upgraded by a single private key

Description and use

The author built a registry that instantly identifies whether a proxy contract is controlled by a multisig, timelock, or a single EOA, enabling investors to assess upgrade risk before depositing.

Problem

Users depositing into DeFi contracts cannot easily determine if a contract’s upgrade authority is protected by a multisig, timelock, or a single EOA, exposing them to on-chain upgrade risk.

Outcome

Out of 40 contracts, 17 are upgradeable proxies; 4 of those are controlled by a single EOA, meaning any holder of that private key can upgrade the contract without delay.

Workflow

• 1. Input chain and contract address into the registry UI or API.
• 2. The registry reads the proxy‑admin storage slot and resolves the admin address.
• 3. It determines if the admin is a contract (multisig/timelock) or a plain EOA.
• 4. It returns the admin type, upgrade path, and links to raw JSON evidence.
• 5. Users review the result to assess upgrade risk before depositing.

Evidence

4 / 40 (10%) are both upgradeable and controlled by a plain EOA

Source

If you're depositing into a contract, "is it a proxy" is the wrong first question…

Source