TVL Behind Upgradeable Contracts Without a Timelock
Quick answer. $20.6 billion of the $95.0 billion Ethereum TVL at 25 large DeFi protocols (22%) sits where a multisig can change core code with no delay. Counting only deposits those contracts hold or issue, it is $8.0 billion.
Video transcript
Over a fifth of Ethereum TVL at 25 large DeFi protocols sits where a multisig can change core code with no delay. New code can run before holders can leave.
We re-read our admin key census and joined it with DefiLlama's TVL. Of 95 billion dollars, 20.6 billion dollars, about 22 percent, has no upgrade delay.
Five protocols carry it, led by SSV Network and EigenLayer, then Falcon Finance, Pendle and Liquid Collective. This shows what the contracts allow, not how teams use them.
Counting only deposits those contracts hold or issue, it is 8.03 billion dollars, at EigenLayer, Falcon and Liquid Collective. SSV's contract does not hold the staked ETH.
A timelock only helps on paths that run through it. EigenLayer's routine upgrades wait ten days, but nine of its thirteen Community Multisig signers can upgrade at once. Kelp's registry is a second, instant path.
Delays are short, too. Over half the sample's TVL, 52.9 percent, could see new code in under three days.
Allocators should require a delay on every code path, longer than their exit, and emergency keys that can only stop. Check the chain, not the docs, and alert on every upgrade.
Guardian's allocator diligence covers who can upgrade, pause or drain a position, and monitoring flags code changes the day they happen. Read the full report, or talk to Guardian.
An upgrade with no delay means new code can run before holders can leave. For an allocator, it is the shortest path from a key to a deposit.
Our admin key census found five of 25 large protocols where a multisig can upgrade core code at once. This report puts a dollar figure on that.
We re-read the census at a fresh block and joined it with DefiLlama's TVL. Protocols are named because everything here is public chain state. Individual signers are not.
A listing describes what the contracts allow, not how a team uses them.
How We Counted
- Sample. The census's 25 protocols, ranked 1 to 36 by Ethereum TVL on DefiLlama on November 4.
- Block. Re-read at block 26,351,262 (November 5, 2026, 21:16 UTC).
- Checks. All 141 census checks passed, and none of its 72 live powers changed.
- TVL. DefiLlama's Ethereum TVL, read at 21:27 UTC that day, grouped by parent protocol.
- Path. Each protocol's TVL goes to its fastest way to change core code.
- Strict figure. Value held in, or issued by, the contracts that can change at once.
Strict-figure balances were read at the same block and priced with DefiLlama's price API at the block's time.
Limits. Ethereum mainnet only. Parent groups include products we did not read, such as Aave's other markets.
TVL moves daily. DefiLlama showed most ETH-based protocols down about 7% that day, so figures sit below the census's November 4 ones.
Any governance action can change a holder or a delay. We did not model withdrawal times.
TVL Behind Instant Upgrades
Of $95.04 billion in Ethereum TVL, $20.59 billion (21.7%) sits in five protocols where a Safe can change core code with no delay.
| Fastest path to a code change | Protocols | Ethereum TVL | Share |
|---|---|---|---|
| Token vote, then a timelock | 7 | $51.10B | 53.8% |
| Multisig, no delay | 5 | $20.59B | 21.7% |
| No upgrade path | 7 | $15.39B | 16.2% |
| Multisig, then a timelock | 5 | $6.86B | 7.2% |
| Operator vote, then a delay | 1 | $1.09B | 1.2% |
Next, the five.
| Protocol | Ethereum TVL | Instant path | Holds the deposits? |
|---|---|---|---|
| SSV Network | $11.79B | 5-of-9 Safe upgrades SSVNetwork | No |
| EigenLayer | $5.76B | 9-of-13 Community Multisig, skipping a 10-day timelock | Yes |
| Falcon Finance | $1.66B | 4-of-6 Safe upgrades USDf | Issues USDf |
| Pendle | $0.77B | 3-of-5 Safe changes router and market factory | Not traced |
| Liquid Collective | $0.62B | 4-of-7 Safe upgrades River (LsETH) | Yes |
The strict figure: $8.03 billion
An upgrade matters most where the contract holds the money. Counting only that, the figure is $8.03 billion, 8.5% of the sample.
- EigenLayer, $5.76 billion. Its executor Safe, described below, upgrades the StrategyManager, the EigenPod beacon and all 86 whitelisted strategies.
- Falcon Finance, $1.66 billion. 1.67 billion USDf in circulation, all inside the token the Safe can upgrade.
- Liquid Collective, $0.61 billion. River accounts for 274,387 ETH behind LsETH.
Two are left out. DefiLlama counts 5.23 million ETH for SSV Network, but the SSVNetwork contract itself held 375 ETH and 5.86 million SSV, about $13.6 million.
Pendle's deposits sit in market and SY contracts we did not trace. Its instant path covers the router and the market factory.
Timelocked but Bypassable
A timelock protects holders only on the paths that go through it.
EigenLayer. Its upgrades belong to an executor Safe that needs one signature from either of two signers. Both are contracts: the 10-day timelock and the 9-of-13 Community Multisig.
So routine upgrades wait 10 days, but 9 of the Community Multisig's 13 signers can upgrade at once.
EigenLayer's governance docs call this an emergency power: time-critical upgrades, or replacing the timelock after a key compromise.
Kelp, $0.87 billion. Upgrades wait 10 days. The 6-of-11 Safe that proposes them can also repoint registered contracts and asset strategies at once.
We count EigenLayer as no delay. Kelp stays in the timelock group, but its registry is a second, instant path.
How long holders have
Most delays are short. $50.31 billion (52.9%) could see new code in under three days. Only $6.61 billion (7.0%) gets a week or more.
| Delay on the fastest code path | Protocols | Ethereum TVL | Share |
|---|---|---|---|
| None | SSV Network, EigenLayer, Falcon, Pendle, Liquid Collective | $20.59B | 21.7% |
| 1 day | Aave V3, Fluid | $14.14B | 14.9% |
| 2 days | Spark, Sky, Compound V3, Re, Grove | $15.58B | 16.4% |
| 3 days | mETH, Maple | $0.86B | 0.9% |
| 4 days | Lido | $21.86B | 23.0% |
| 7 days | Rocket Pool | $1.09B | 1.2% |
| 10 days | ether.fi, Kelp | $5.52B | 5.8% |
| No upgrade path | Morpho, Ethena, Uniswap, Curve and 3 more | $15.39B | 16.2% |
Lido's four days can stretch: stETH holders can extend them through Dual Governance, as the census notes.
By Vertical and Chain
Instant upgrades cluster in the restaking and staking pool categories. The lending, CDP and DEX protocols in the sample have none.
| DefiLlama category | Protocols | Ethereum TVL | No delay |
|---|---|---|---|
| Liquid Staking | 6 | $29.63B | 2% |
| Lending | 6 | $29.27B | 0% |
| Staking Pool | 1 | $11.79B | 100% |
| Basis Trading | 2 | $6.66B | 25% |
| Restaking | 1 | $5.76B | 100% |
| CDP | 1 | $5.00B | 0% |
| DEXs | 2 | $3.60B | 0% |
| Yield | 2 | $1.26B | 61% |
| Four other categories | 4 | $2.08B | 0% |
Small categories swing on one protocol. Yield is Pendle and Convex; Basis Trading is Falcon and Ethena.
The chain view is simple: this is Ethereum mainnet only. Deployments on other chains are separate contracts, and we did not read them.
What Allocators Should Require
- A delay on every code path. Proxies, beacons, routers and registries, not just the proxy admin.
- A delay longer than your exit. Compare it with withdrawal queues and unbonding periods.
- Emergency keys that can only stop. If an emergency path can upgrade, know who signs and when.
- A higher bar on any instant path. Upgrade Safes in our statistics need a median of 4 signatures.
- The chain, not the docs. Docs and chain disagreed at six of the 25 census protocols.
- An alert on every upgrade. Hear the same day an implementation changes at your addresses.
Thresholds for each Safe are in our Safe multisig statistics. For the full review, see our DeFi protocol due diligence checklist.
How Guardian Helps
Guardian's capital allocator diligence covers who can upgrade, pause or drain a position: signer sets, thresholds, timelocks and admin keys.
Monitoring then watches new implementations, proxy changes and timelock changes at the addresses you are exposed to. Material moves reach you the day they happen.
Protocol teams can track the same rights on their own contracts with Risk Monitoring.
Frequently Asked Questions
How much DeFi TVL can be upgraded with no timelock?
In our sample of 25 large protocols on Ethereum, $20.59 billion of $95.04 billion (21.7%) sits where a multisig can change core code at once. Counting only deposits held or issued by those contracts, it is $8.03 billion.
Why is an instant upgrade a risk?
New code runs before holders can react. Whoever controls the upgrade can, in principle, change what a contract does with deposits. A timelock gives holders time to see the change and leave.
Is a timelock enough?
Only if every path goes through it and the delay beats your exit time. At EigenLayer and Kelp, a Safe can act outside a 10-day timelock. Over half of the sample's TVL could see new code in under three days.
Which DeFi sectors have the most instant upgradeability?
In this sample, restaking and staking pools. All of EigenLayer's and SSV Network's TVL sits behind instant paths, though SSV's contract does not hold the staked ETH. The lending, CDP and DEX protocols had none.
Sources
- Guardian: Who Controls DeFi? Admin Keys Behind 25 Top Protocols (November 2026)
- Guardian: Safe Multisig Statistics, 39 Safes Behind DeFi Admin Keys (November 2026)
- DefiLlama: protocols API, Ethereum TVL and category by protocol (read Nov 5, 2026, 21:27 UTC)
- DefiLlama: SSV Network protocol API, TVL by token (read Nov 5, 2026)
- DefiLlama: coins API, ETH, USDf and SSV prices at block 26,351,262
- Etherscan: EigenLayer StrategyManager (state read at block 26,351,262)
- Etherscan: EigenLayer ProxyAdmin
- Etherscan: EigenLayer Executor Multisig (signers: timelock and Community Multisig)
- Etherscan: EigenLayer Timelock (10-day minimum delay)
- Etherscan: EigenLayer Community Multisig (9-of-13)
- Eigen Foundation: Protocol governance, technical architecture (read Nov 5, 2026)
- Etherscan: EigenLayer EigenPodManager
- Etherscan: Falcon Finance USDf
- Etherscan: Liquid Collective River (LsETH)
- Etherscan: SSV Network SSVNetwork
- Etherscan: SSV DAO Safe (5-of-9), owner of SSVNetwork
- Etherscan: Falcon Finance admin Safe (4-of-6), owner of the USDf ProxyAdmin
- Etherscan: Pendle governance Safe (3-of-5)
- Etherscan: Liquid Collective proxy administrator Safe (4-of-7)
- Etherscan: PendleRouterV4
- Etherscan: PendleMarketFactoryV6
- Etherscan: Kelp LRTConfig
- Etherscan: Kelp External Admin Safe (6-of-11)
- Kernel DAO docs: Kelp access control and multisigs (read Nov 5, 2026)
Know who can change your position
Guardian traces who can upgrade, pause or drain each position you hold, and tells you the day it changes.