A protocol’s real security model is often not in its contract logic at all. It is in the answer to a simpler question: who can change the logic, and how quickly can they do it?
Find out whether it is upgradeable
Most substantial deployments use a proxy contract: the address users interact with holds the state and delegates behaviour to a separate implementation address, which can be swapped. Block explorers usually detect this and show the implementation contract alongside the proxy.
If a contract is upgradeable, “immutable code” is not a property it has. That is not automatically bad — it is how bugs get fixed after deployment — but it changes what you are trusting from the code to the people who control it.
Identify the admin, and what kind of thing it is
The proxy has an admin address with the power to upgrade. What that address is matters more than its value:
- A single externally owned account. One key, one person, no second approval. The weakest arrangement, and readable as such.
- A multisig. Better — but the two numbers that matter are the threshold and the signer count, and both are on-chain. Three-of-five is only meaningfully three-of-five if the five keys are held by different people on different devices, which the chain cannot tell you.
- A governance contract behind a timelock. The strongest of the three, because it converts an instant change into an announced one — provided somebody is watching the queue.
Check the delay, and whether it can be bypassed
Where a timelock exists, its delay is readable from the contract, as is the queue of pending actions. Two things are worth establishing: how long the delay actually is, and whether any path exists to act without it — an emergency role, a guardian, or a pause function held separately.
A circuit breaker or pause function is usually a good thing, but it is also a power. Who may call it, and what unpauses it, are part of the same control chain.
Why this is the question that recurs
Records in the tracker turn on control far more often than on cryptography. Governance that could execute without a delay is the shape in the Beanstalk governance flash loan. Legitimately held privileged access is the shape in the Munchables insider key compromise — see also insider threat.
What you can establish, and what you cannot
On-chain you can establish: whether the contract is upgradeable, the implementation address, the admin address, whether the admin is a multisig and at what threshold, whether a timelock exists and its delay, and what is currently queued.
You cannot establish from the chain alone whether the signers are genuinely independent people, where the keys are held, or what happens if one is lost. Those are disclosure questions, and a project that answers them in writing is telling you something a project that does not answer them is also telling you.
Not advice. Conisec reports for information only. Nothing in this article is financial, legal, tax or security advice. Verify against the primary sources linked above before acting on anything.
