DeFi admin-key research
30
single-key admin cases (2 Critical, 13 High, 7 Medium, 8 Low) among 108 DeFi protocols and Morpho vault owners checked by hand on-chain. The same pattern was behind Wasabi Protocol's $5.9M loss.

Check your protocol's admin key

Paste a contract address on Ethereum mainnet. This runs a simplified, free subset of the research method, live in your browser: owner(), admin(), the standard proxy admin and beacon slots, and the owners and threshold of any Safe found. It does not read role-based access control (AccessControl) or immutable proxy admins. When you press Check, the address is sent only to the three public RPC endpoints named at the bottom of this page. The page loads no third-party fonts, scripts or trackers.

github.com/RealSpap/defi-admin-key-risk-showcase

Ethereum mainnet only. No wallet connection needed. Read-only calls to public no-key RPC endpoints.

Known cases matched by this tool

This free check classifies the admin pattern only: bare EOA, 1-of-N Safe, real multisig, renounced, or a contract that needs a manual look. When it cannot verify (an RPC error), it says so and gives no verdict. It does not chase a hit to a dollar figure and it does not check for documented third-party targeting. The full research check does both of those for every bare-EOA and 1-of-N-Safe result it flags, which is how the Critical / High / Medium / Low severity calls in the published cases are made. Questions, or the full check on your own protocol: x.com/RealSpap.