Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
An address need not mean fixed code
A proxy can preserve an address while replacing implementation logic. Explorer source verification generally establishes a code match, not safety. Identify proxy patterns, implementation addresses, and storage handling before reviewing behavior. Map upgrade, pause, and fund-management powers separately instead of inferring permissions from the product interface.
Who controls administration
Administration may sit with a key, multisig, governance contract, or another proxy. Trace control to its ultimate conditions, including role delegation and emergency bypasses. Labels do not prove legal identity. Claims of renounced ownership require checking every relevant role and immutable mechanism, not merely one transaction to a zero address.
Multisig thresholds and shared failures
Thresholds affect control and availability, but signer count alone is insufficient. Shared cloud accounts, devices, or organizations can undermine independence. Inspect owners, threshold, modules, and recovery mechanisms, and confirm that upgrades actually require the advertised multisig. Additional modules may create execution paths outside the ordinary signature threshold.
What a timelock provides
Timelocks provide an observation interval, not assured escape. Check minimum delay, who can alter it, bypasses, and emergency powers. Exit can still be constrained by vesting, bridge delays, or liquidity. Evaluate the timelock together with a feasible withdrawal path and monitoring arrangements rather than treating delay alone as sufficient protection.
Verify the proposed change
Compare old and new code, compiler settings, storage layouts, and initializers. Incompatibility can corrupt balances or permissions, while repeated initialization may reset control. Match audit scope to the exact commit. Older reports do not automatically cover upgrades. Readers without specialist skills should document unresolved technical questions rather than assume an audit badge resolves them.
Monitor changes over time
Snapshot proxy, implementation, admin, timelock, and critical roles, and monitor upgrade and role-change events. Reconcile events with live state because nonstandard paths can be missed. An anomaly warrants pausing new approvals and checking notices. Ongoing permission review is more useful than treating a launch-time assessment as permanent.
Worked review example
Suppose upgrades are advertised as two-of-three approval plus a two-day delay. Trace the actual multisig, timelock, and proxy admin. An emergency module permitting immediate replacement must appear as a separate path. Compare queued and executed calls with the proposal. The example distinguishes published promises, enforced constraints, and bypasses rather than treating them as one protection.
