★Single admin EOA

Methodology how we score#

What this measures
This factor identifies whether the effective upgrade, ownership, or rescue role for a deployed protocol is held by a single externally owned account (EOA) — with no multisig co-signers and no timelock delay imposed on sensitive operations. An on-chain read of the owner, admin, or equivalent role slot is sufficient to surface this state. The factor is triggered when a single private key, if compromised, could immediately alter protocol parameters, drain funds, or upgrade implementation logic without any social or temporal check.

Why it matters
A single admin EOA is the most direct path from key compromise to full protocol drain. Industry guidance consistently frames multi-party approval as the minimum bar for any protocol holding material user funds: OpenZeppelin notes that "secure access controls play a significant role in the security of governance modules" and that time-delayed execution prevents changes from bypassing community review. Across this dataset, the pattern is consistent — wherever a single EOA holds unchecked admin power, that key becomes the entire attack surface. The shift toward off-chain key compromise as the leading dollar-volume vector in 2024–2026 makes this factor increasingly load-bearing; no on-chain code quality compensates for a single point of key failure.

Green / Yellow / Red
A protocol is graded green when the highest-privilege role is held by a multisig with a meaningful threshold (at least 2-of-N with N at least 3) and a timelock of at least 24 hours on upgrade and rescue actions. Yellow is assigned when a multisig exists but the timelock is absent or under 12 hours, or when the threshold is 2-of-3 with no additional safeguards. Red is assigned when any upgrade, rescue, or ownership role is held by a single EOA with no timelock, regardless of claimed operational intent.

Common gray cases
This factor is grayed when the protocol has announced admin renunciation or migration but on-chain confirmation has not yet propagated at the time of assessment, or when proxy architecture obscures role assignment and the source cannot be verified within the assessment window.

Notable historical examples
- EasyFi ($59M, 2021): Single admin key executed a direct token transfer with no timelock; the key compromise was the exploit mechanism.
- Multichain ($126M, 2023): MPC key control centralized in a single party enabled complete cross-chain drain.
- Drift Protocol ($285M, 2026): Security Council reduced from 3/5 to 2/5 and timelock removed days before exploit; effective admin authority concentrated in a compromised key.
- Radiant Capital ($53M, 2024): Multisig transactions transferring pool ownership were the exploit delivery mechanism after signer compromise.
- bZx ($55M, 2021): Compromised EOA held admin control across Polygon and BSC deployments; legitimate admin functions were the drain vector.

★ Critical factor
This factor alone is sufficient to trigger a D or F grade under rubric v1.5 — a single red assessment here overrides all other category scores. A protocol where the sole admin key is an unguarded EOA presents a complete drain vector that no amount of code quality or audit coverage can mitigate.

Measurement what to look for#

Determine whether the effective upgrade/owner/rescue role is held by a single EOA (not a multisig) with no timelock on sensitive operations.

Data & output #

Scored protocols 0 carry this factor#

Linked hacks 39 historical incidents#