4 of the 40 biggest DeFi contracts I checked can be upgraded by a single private key

说明与用途

作者构建了一个注册表，能即时识别代理合约是由多签、时间锁还是单一EOA控制，从而让投资者在存款前评估升级风险。

问题

Users depositing into DeFi contracts cannot easily determine if a contract’s upgrade authority is protected by a multisig, timelock, or a single EOA, exposing them to on-chain upgrade risk.

结果

Out of 40 contracts, 17 are upgradeable proxies; 4 of those are controlled by a single EOA, meaning any holder of that private key can upgrade the contract without delay.

工作流

• 1. Input chain and contract address into the registry UI or API.
• 2. The registry reads the proxy‑admin storage slot and resolves the admin address.
• 3. It determines if the admin is a contract (multisig/timelock) or a plain EOA.
• 4. It returns the admin type, upgrade path, and links to raw JSON evidence.
• 5. Users review the result to assess upgrade risk before depositing.

证据

4 / 40 (10%) are both upgradeable and controlled by a plain EOA

来源

If you're depositing into a contract, "is it a proxy" is the wrong first question…

来源