★ Single admin EOA

Methodology how we score #

**What this measures** This factor identifies whether the effective upgrade, ownership, or rescue role for a deployed protocol is held by a single externally owned account (EOA) — with no multisig co-signers and no timelock delay imposed on sensitive operations. An on-chain read of the owner, admin, or equivalent role slot is sufficient to surface this state. The factor is triggered when a single private key, if compromised, could immediately alter protocol parameters, drain funds, or upgrade implementation logic without any social or temporal check.

**Why it matters** A single admin EOA is the most direct path from key compromise to full protocol drain. Industry guidance consistently frames multi-party approval as the minimum bar for any protocol holding material user funds: OpenZeppelin notes that "secure access controls play a significant role in the security of governance modules" and that time-delayed execution prevents changes from bypassing community review. Across this dataset, the pattern is consistent — wherever a single EOA holds unchecked admin power, that key becomes the entire attack surface. The shift toward off-chain key compromise as the leading dollar-volume vector in 2024–2026 makes this factor increasingly load-bearing; no on-chain code quality compensates for a single point of key failure.

**Green / Yellow / Red** A protocol is graded green when the highest-privilege role is held by a multisig with a meaningful threshold (at least 2-of-N with N at least 3) and a timelock of at least 24 hours on upgrade and rescue actions. Yellow is assigned when a multisig exists but the timelock is absent or under 12 hours, or when the threshold is 2-of-3 with no additional safeguards. Red is assigned when any upgrade, rescue, or ownership role is held by a single EOA with no timelock, regardless of claimed operational intent.

**Common gray cases** This factor is grayed when the protocol has announced admin renunciation or migration but on-chain confirmation has not yet propagated at the time of assessment, or when proxy architecture obscures role assignment and the source cannot be verified within the assessment window.

**Notable historical examples** - **EasyFi** ($59M, 2021): Single admin key executed a direct token transfer with no timelock; the key compromise was the exploit mechanism. - **Multichain** ($126M, 2023): MPC key control centralized in a single party enabled complete cross-chain drain. - **Drift Protocol** ($285M, 2026): Security Council reduced from 3/5 to 2/5 and timelock removed days before exploit; effective admin authority concentrated in a compromised key. - **Radiant Capital** ($53M, 2024): Multisig transactions transferring pool ownership were the exploit delivery mechanism after signer compromise. - **bZx** ($55M, 2021): Compromised EOA held admin control across Polygon and BSC deployments; legitimate admin functions were the drain vector.

**★ Critical factor** This factor alone is sufficient to trigger a D or F grade under rubric v1.7.0 — a single red assessment here overrides all other category scores. A protocol where the sole admin key is an unguarded EOA presents a complete drain vector that no amount of code quality or audit coverage can mitigate.

Measurement what to look for #

Determine whether the effective upgrade/owner/rescue role is held by a single EOA (not a multisig) with no timelock on sensitive operations.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 39 historical incidents #