Admin/upgrade transaction in mempool
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when an admin-role or upgrade transaction appears in the public mempool — before block confirmation — from an admin, upgrader, or owner address of the monitored protocol. The signal is generated by monitoring mempool transactions from known protocol-admin addresses against a library of admin-function signatures (upgradeTo, transferOwnership, grantRole, setAdmin, pause, unpause). Category 6 context: admin transactions appearing in the mempool provide a last-moment warning window before the transaction confirms — typically five to 60 seconds on fast chains.
**Why it matters** Admin transactions that initiate protocol changes are the on-chain execution step of governance decisions — or, in the case of rogue-insider attacks, the execution step of a drain. EasyFi ($59M, 2021) had a single admin key executing transfer() with no timelock — the admin transaction appearing in the mempool would have been the only pre-confirmation warning. Munchables ($62.5M, 2024) involved a proxy upgrade to an unverified implementation — the upgrade transaction appearing in the mempool was the final visible step before the drain. Even with seconds of lead time, a mempool alert enables automated circuit breakers and depositor withdrawal initiation.
**Green / Yellow / Red** Green is the baseline when no admin transactions from protocol-admin addresses appear in the mempool outside of scheduled governance windows. Yellow fires when an admin transaction appears in the mempool consistent with a scheduled and publicly disclosed upgrade or parameter change. Red fires when an admin transaction appears in the mempool with no corresponding governance discussion, outside of any known upgrade schedule, or from an admin address that has been dormant for 30 or more days.
**Common gray cases** Gray applies on chains where mempool is not publicly observable (private mempool chains, some L2s), or when admin transactions are routed through private relay services (Flashbots) that are not visible in the public mempool.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect an admin-role or upgrade transaction appearing in the mempool before confirmation.