Upgrade multisig signer configuration (M/N)
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor counts the number of distinct addresses that hold any admin role across the protocol's deployed contract system — including owner, ProxyAdmin, upgrader, pauser, minter, fee collector, oracle setter, and any other role with elevated permissions. The count is produced by an on-chain sweep of AccessControl role members and owner slots across all contracts associated with the protocol.
**Why it matters** The count of distinct admin addresses sets the floor for understanding the protocol's attack surface. A protocol with a single admin address is maximally centralized; one with twenty role-separated addresses across multiple independent parties has a dramatically larger attacker burden. The evidence base shows that protocols with very small admin address counts — particularly those where count equals one — are over-represented in the off-chain key compromise cluster. The count alone is not graded as critical (role separation and threshold are assessed separately), but it is a required display field that contextualizes every other governance signal.
**Green / Yellow / Red** Green is assigned when three or more distinct addresses hold clearly-separated roles (upgrader, pauser, oracle setter, and fee collector are held by different addresses or multisigs). Yellow covers cases where two to three addresses hold the full role set, or where the count is high but roles overlap significantly. Red is assigned when a single address holds all elevated roles, regardless of whether that address is an EOA or a multisig — single-address role concentration is the underlying condition for RD-F-027.
**Common gray cases** This factor is grayed when on-chain AccessControl events are absent and source inspection is required but unavailable within the assessment window, or when a protocol uses factory-deployed contracts where role inheritance is unclear.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Read `threshold` and `getOwners()` on the multisig controlling upgrade / sensitive ops. Store as `required` (M) and `total` (N); render as "M/N". For EOA admins record `required=1, total=1` (display "1/1"). Null when admin is immutable or full DAO with no fixed signer set.