The leaks · 47 / 86 · 2 min
Admin keys and upgradeable contracts
An admin key can change the program after you have deposited. Upgradeable means the address you trusted can point at new code tomorrow.
Upgradeable means the address you trusted can mean something else tomorrow.
A worked case
A person checks the contract they deposited into and saves the address. The address is a proxy. The admin changes the implementation. The saved address is the same. The program is not.
Who can change the rules
A single key, a small multisig, or a vote that is easy to buy. If deposits sit in the contract, that person can change how withdrawals work.
What to look for
Proxy, owner, timelock. A timelock at least makes the change wait. No delay means the change can be instant.
A project that says the key is for emergencies still has the key. Emergencies are defined by them.
The address stayed. The program did not.
Upgradeable contracts, often a proxy, let an admin point a familiar address at new code. That is how teams patch bugs without asking every user to migrate. It is also how a deposit you reviewed becomes a different program. The DAO fork was a loud version, done in public by a whole chain. A proxy upgrade is a quiet version, done by a key the website calls a multisig and does not always name.
Rollups in their early years were explicit about this. Optimism and others documented admin keys that could upgrade the bridge. Some of those keys were later moved toward delays and wider committees. The honest teams wrote the key down. The lesson is to look for the page where the key is written down. If there is no such page, the key still exists until someone proves it does not.
A saved address is not a saved program. Check what the proxy points at on the day you deposit, and who can change the pointer.
Read it yourself
These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.
Apply the check
Open a question. The line is about this topic. It is not a verdict that anything is safe.
The admin, if the new code pays them.
The admin key, or a multisig of admins.
The new code, which can move what the old code held.
Check yourself
If you deposited last week, can the code still change?
Yes, if an admin or a proxy can point at new code.
After this you can find who can upgrade the contract, and how fast.