4 of the 40 biggest DeFi contracts I checked can be upgraded by a single private key

Описание и применение

Автор создал реестр, который быстро определяет, управляется ли прокси‑контракт мультисигом, тайм‑локом или одной EOA‑адресом, что позволяет инвесторам оценить риск мгновенного обновления кода.

Задача

Users depositing into DeFi contracts cannot easily determine if a contract’s upgrade authority is protected by a multisig, timelock, or a single EOA, exposing them to on-chain upgrade risk.

Результат

Out of 40 contracts, 17 are upgradeable proxies; 4 of those are controlled by a single EOA, meaning any holder of that private key can upgrade the contract without delay.

Рабочий процесс

• 1. Input chain and contract address into the registry UI or API.
• 2. The registry reads the proxy‑admin storage slot and resolves the admin address.
• 3. It determines if the admin is a contract (multisig/timelock) or a plain EOA.
• 4. It returns the admin type, upgrade path, and links to raw JSON evidence.
• 5. Users review the result to assess upgrade risk before depositing.

Доказательства

4 / 40 (10%) are both upgradeable and controlled by a plain EOA

Источник

If you're depositing into a contract, "is it a proxy" is the wrong first question…

Источник