The leaks · 47 / 86
Admin keys and upgradeable contracts
An admin key can change the program after you have deposited. Upgradeable means the address you trusted can point at new code tomorrow.
Who can change the rules
A single key, a small multisig, or a vote that is easy to buy. If deposits sit in the contract, that person can change how withdrawals work.
What to look for
Proxy, owner, timelock. A timelock at least makes the change wait. No delay means the change can be instant.
A project that says the key is for emergencies still has the key. Emergencies are defined by them.
Check yourself
If you deposited last week, can the code still change?
Yes, if an admin or a proxy can point at new code.
After this you can find who can upgrade the contract, and how fast.