Security · S2

Upgrade authority

Who can change the contract code, and with how much notice?

Why it matters

An upgrade key can replace every other guarantee on this page in one transaction. Its holder and delay are the ceiling on how much the rest can be trusted.

A score of 3 needs onchain evidence about the deployed contracts, not only source code at a commit.

Scoring anchors

3 Strong	Non-upgradeable; or the upgrade admin is a Safe of at least 2-of-3 with disclosed signers and no threshold-bypassing module or guard, behind a timelock at least as long as the documented user exit, with a user notice channel named in the repo.
2 Partial	Multisig admin with a timelock, but the timelock is shorter than the user exit, signers are undisclosed, or no notice channel is named.
1 Weak	Multisig admin, no timelock.
0 Fails	EOA admin, or undisclosed proxy admin.
No evidence	No admissible evidence submitted yet. Counts as 0 in the pillar.

Admissible evidence

EIP-1967 admin and implementation slots read onchain verified
Safe threshold read onchain verified
Timelock contract read onchain verified
Safe modules and guard of the admin Safe read onchain verified

Common failures

Checking the proxy admin contract but not who owns it.

Current ratings

Provider	Score	Finding
Aleo (credits.aleo private transfers)	2 Partial	credits.aleo and the consensus rules change only through snarkVM releases with fixed activation heights, which the 23 validators must run. Provable maintains the only implementation we found, and it has shipped 21 consensus versions in about two years, each activated at a block height fixed in the release; we did not check how far ahead each release shipped. There is no enforced delay or user-exit window. Judgment call: notice exists through heights fixed in releases (V21 carried a target date in code), so we take 2, as for other own-chain protocols; 3 would also need onchain evidence the schema cannot carry. The restrictions list is scored under C1.
AnomaPay	1 Weak	The contract code cannot be changed, but the stop-and-migrate path lets a 3-of-5 multisig move all funds to a new adapter version of its choosing, which works as an upgrade. Judgment call: we treat that as upgrade authority and score 1 (multisig, no timelock) rather than 3.
Avalanche Card	No evidence	No admissible evidence yet.
Avici Card	No evidence	No admissible evidence yet.
Aztec (Alpha mainnet private token transfers)	2 Partial	Deployed rollup code cannot be changed in place: upgrades register a new rollup version, which needs sequencer signalling plus an AZTEC token vote, at least 12 days from proposal to execution (3-day delay, 7-day vote, 2-day execution delay), far longer than the roughly one-epoch exit to L1. The old rollup stays usable for exits. But state does not migrate, so users must move funds at each upgrade, and governance execution can call any contract. Judgment call: the timelock exceeds the user exit and the notice channel is the Alpha docs, which supports 3 in substance; we take 2 because 3 needs onchain evidence this row cannot carry and because forced migrations shift work and risk onto users.
Bitget Wallet Card	0 Fails	Every settlement contract is upgradeable at once by a single EOA, with no timelock. EOA admin, so 0.
Blanksquare (Shielder)	1 Weak	A 2-of-5 Safe can upgrade the Shielder at once; there is no timelock and we found no signer disclosure or notice channel. Scored 1: multisig admin, no timelock.
COCA Card	No evidence	No admissible evidence yet.
Coinbase Commerce (Onchain Payment Protocol)	3 Strong	Neither Base Transfers contract can be upgraded. Coinbase changes behaviour by deploying a new contract and pointing its API at it. It has done this at least six times on Base, and the new address carries no notice to anyone integrating directly. Integrators who call a fixed address keep the old code. The pause power is scored under C1.
Curvy	1 Weak	A 4-of-6 Safe with no modules or guard can upgrade the vault and aggregator directly, with no timelock. We found no disclosure of the signers. Scored 1: multisig admin, no timelock.
Daimo Pay	3 Strong	Re-assessed under the updated anchor; the score is unchanged because the first branch of anchor 3 (non-upgradeable) applies, so the Safe, module, guard, and timelock conditions do not arise. None of the settlement contracts can be upgraded. Each deposit address uses an ERC-1967 proxy, but its implementation exposes no upgrade function and the admin slot is empty. Daimo can deploy new manager versions and have the API point new sessions at them. A deposit address that already exists stays bound to its original escrow, so this does not change open sessions. The bridge protocols used for cross-chain routes, such as CCTP and Stargate, have their own admin keys, which are outside this cell.
Deblock Card	No evidence	No admissible evidence yet.
Ethena Pay	1 Weak	All wallet logic is upgradeable through the factory, which a 5-of-10 Safe with undisclosed EOA signers can upgrade instantly via its ProxyAdmin; the 48-hour UPGRADE_DELAY inside the factory does not bind that path. The factory implementation is unverified. Multisig admin, no effective timelock, so 1.
ether.fi Cash	2 Partial	Every contract, including every user Safe through the beacon, can be upgraded by a 2-day timelock fed by a 3-of-6 Safe with no modules or guard. Default modules that act on all Safes change behind an 8 h timelock. Both delays exceed the 10 s withdrawal delay (S4), but half the Safe signers are undisclosed and no notice channel is named in the repo. Multisig plus timelock, with undisclosed signers and no notice channel = 2.
Exa Card	1 Weak	ExaPlugin itself is immutable, and each account's implementation can be upgraded only by its owner. The market holding user funds is upgradeable behind a 1-day timelock driven by a 3-of-6 Safe, which on its own would score 2 (signers and notice channel undisclosed). The plugin admin, a 3-of-4 Safe with no timelock, can also swap the ProposalManager and swapper contracts that every withdrawal passes through, which amounts to changing the rules with no notice. Judgment call: that is "multisig admin, no timelock", so 1.
Fluidkey	3 Strong	Nobody but the account owner can change the code behind a stealth account, and the earn module is immutable. Scored 3.
Fuse Card	3 Strong	The program is immutable, and the Main and Card Account configurations can only be changed by the user's own keys. No one at Squads or Bridge can change the code. Non-upgradeable, so 3. The Fuse app could steer users to a different program in future; that is outside this cell.
Gnosis Pay	3 Strong	Re-assessed against the revised anchor, which now asks for modules and guards to be read. Gnosis Pay has no upgrade key over any contract that holds or gates user funds. The account Safe has no guard. Its only modules are Delay and Roles, and the Roles scope read from the setup events allows no delegatecall and no call other than EURe.transfer to the settlement Safe. Only the user, through their own Delay queue, can change the Safe's masterCopy. The Delay, Roles and Spender instances are EIP-1167 minimal proxies with no upgrade path, and Roles ownership sits with a Bouncer that only forwards setAllowance from the Safe. This is the "non-upgradeable" branch of anchor 3, so the admin-Safe conditions do not apply. Judgment call: the spender Safe (2-of-3, one module, no guard) and the settlement Safe (2-of-10, no module, no guard) are ordinary Safe proxies whose owners could change their code. That would not widen access to user accounts, because the Roles scope binds whatever code the spender Safe runs, and funds already in the settlement Safe are provider custody, scored under S1 (1). Token contracts are upgradeable by their issuers (EURe and GBPe are UUPS under a Monerium 3-of-6 Safe); that is covered in C5. The June 2026 incident was handled by issuing new Safes and new mastercopies (account-kit commit f4b92878), not by upgrading in place.
HesabPay	No evidence	No admissible evidence yet.
Hinkal	2 Partial	Hinkal itself is not upgradeable, but swapping the helper and verifiers changes its behaviour as much as an upgrade would. That authority sits with a 6-hour timelock controlled by a 2-of-3 Safe with no modules or guard. We found no disclosure of the signers and no notice channel named in the repo. Scored 2: a multisig with a timelock, but undisclosed signers and no notice channel.
Holyheld Card	0 Fails	The top-up contract can be upgraded at any time by one EOA through the ProxyAdmin, with no timelock and no multisig. EOA admin, so 0.
Houdini Swap	No evidence	No admissible evidence yet.
Hyperbeat Card	0 Fails	Every account is upgradeable and the upgrade authority is undisclosed (and unverifiable, since the contracts are unverified). Undisclosed proxy admin, so 0.
Jupiter Card	No evidence	No admissible evidence yet.
M-Pesa	No evidence	No admissible evidence yet.
MetaMask Card	3 Strong	FoxConnect is not upgradeable, and the same holds for the US deployment. Its owner can still change operators, signer, treasury and beneficiary, which is scored under C1 and S1, not here. The tokens are upgradeable by their issuers (USDC and mUSD are proxies), which is covered under C5.
Opera MiniPay	No evidence	No admissible evidence yet.
Monero	2 Partial	No key can change the rules. Upgrades are hard forks compiled into node releases at fixed heights, announced in the README schedule ahead of time, and effective only if miners and node operators run them; the last one was in August 2022. The core team's MoneroPulse checkpoints are advisory unless an operator enforces them. Judgment call: notice is given by schedule but there is no enforced delay, and 3 would also need onchain evidence this chain cannot supply, so we take 2.
Nullmask	0 Fails	Upgrades are authorised through a controller whose admin is a single EOA, with no timelock visible in its bytecode. Scored 0.
Oobit Card	No evidence	No admissible evidence yet.
Payy Card	1 Weak	A 2-of-4 Safe can upgrade the rollup instantly through the ProxyAdmin. The same Safe can also swap the ZK verifier through addZkVerifier, which is an upgrade in effect. Signers are undisclosed and nothing documents a notice channel. Multisig admin, no timelock, so 1.
Phantom Cash	No evidence	No admissible evidence yet.
Plasma One	0 Fails	Every collateral contract can be upgraded at once by a single Rain EOA through the beacon, with no timelock or notice; the factory is upgradeable by the same EOA. EOA admin, so 0.
Privacy Pools (0xbow)	1 Weak	The pools and verifiers cannot be upgraded. The Entrypoint, through which every deposit and relayed withdrawal passes and which supplies the ASP root the pools check, is upgradeable by a 2-of-4 Safe with no timelock; it was upgraded once in May 2025. A malicious upgrade could not take funds already in the pools, but could stop withdrawals except ragequit, redirect relayed withdrawals, or pull tokens users have approved to it. Signers are not disclosed. Scored 1: multisig admin, no timelock.
Railgun	2 Partial	The RailgunSmartWallet is upgradeable by RAIL governance only: ProxyAdmin → Delegator → Voting, with at least 7 days between a vote being called and execution, longer than the immediate user exit. There is no Safe; the voters are onchain. The repo names no user notice channel beyond the onchain proposal, and governance can also set verification keys via the VKeySetters. Judgment call: 2 (delay longer than exit, no notice channel named).
Request Network	1 Weak	The two fee proxies cannot be upgraded. Erc20ConversionProxy is not a proxy contract, but its owner can repoint the delegatecall target, which in effect replaces its code. That owner is a 3-of-7 Safe with no modules or guard, no timelock, undisclosed signers, and no notice channel. Judgment call: we treat the delegatecall-target setter as upgrade authority, so the cell scores 1 ("multisig admin, no timelock"). The core FeeProxy path alone would score 3.
Rizon Card	No evidence	No admissible evidence yet.
SafePal Card	0 Fails	Every settlement contract is upgradeable at once by a single EOA, with no timelock. EOA admin, so 0.
Solayer Card (Emerald Card / Solayer Pay)	No evidence	No admissible evidence yet.
Tongo (confidential ERC-20 on Starknet)	2 Partial	The ledger and Vault classes are non-upgradeable. The docs' class hashes match getClassHashAt for the v2 instances at block 16117583, but we could not verify that this source compiles to them (O1). Judgment call: the substance fits 3, but without onchain evidence in the schema and without class verification, 2.
Tornado Cash (Classic pools)	3 Strong	No one can change the pool, verifier or router code: none is a proxy, and the one pool role that could swap the verifier is set to zero. TORN governance (5-day vote, 2-day execution delay, delegatecall execution) can upgrade the InstanceRegistry, RelayerRegistry and FeeManager, which only the optional router path consults, and it owns the tornadocash.eth name that serves the UI. Proposal 20's target was created after its vote closed and carries a selfdestruct, which shows that code executed by governance need not be the code voters saw. Judgment call: we score the settlement contracts at 3; the governance risk is in the router path and the frontend, both of which a user can avoid.
Tria	No evidence	No admissible evidence yet.
Tuyo Card	No evidence	No admissible evidence yet.
Umbra Cash	3 Strong	Non-upgradeable. The owner can change only the toll settings (see C1).
Wirex One	0 Fails	One EOA can upgrade every BaaS contract (implementations were redeployed around block 52.04M, days before this read) with no timelock. EOA admin, so 0.
Wise	No evidence	No admissible evidence yet.
WORM (BETH proof-of-burn)	3 Strong	No one can change the code: every contract in the payment path is non-upgradeable with no admin. Later fixes on the main branch (configurable pool share) would need a new deployment, so they are not in force.
XPlace Card	2 Partial	The program that holds XPlace collateral can be upgraded by a Kamino Squads multisig, 5 of 10, after a 24-hour time lock. The members are bare keys with no published identities, and no notice channel is named in the klend repo. That is anchor 2. Judgment call: XPlace's own claimed contracts and the Rain collateral path were not found, so this score covers only the identified program; finding either could lower it.
Zcash (shielded transfers)	2 Partial	No key can change the rules. Network upgrades are specified as ZIPs, compiled into node releases with fixed activation heights, and take effect only if miners and node operators run them; scheduled upgrades are announced weeks ahead in the ZIPs and release notes. The emergency soft fork of June 2026 had no advance notice, and the 84-day end-of-support halt pushes operators onto new releases. Judgment call: scheduled upgrades give notice but there is no enforced delay, and emergency changes give none; that resembles anchor 2 more than 3, and 3 would also need onchain evidence this chain cannot supply.
zERC20 (zBNB on BNB Chain)	1 Weak	All core contracts are UUPS proxies upgradeable at once by two 3-of-4 Safes that share the same undisclosed EOA signers. There is no timelock and no notice channel. Neither Safe has a module or a guard. Scored 1: multisig admin, no timelock.