Who Controls DeFi? Admin Keys Behind 25 Top Protocols

Updated November 2026 7 min read

Quick answer. Guardian traced the admin keys of 25 of the largest DeFi protocols on Ethereum from chain state. At 5, a multisig can upgrade with no delay; at 8, one key can pause, freeze or blacklist without a timelock.

Watch: Who Controls DeFi? Admin Keys Behind 25 Top Protocols 1:33

Video transcript

Guardian traced the admin keys of 25 of the largest DeFi protocols on Ethereum. At five, a multisig can upgrade the code with no delay.

SEC staff guidance lists powers that can make a central party. Each is a contract function, held by an address anyone can look up. Whether any protocol is one is a legal question.

We read each core contract at one block, rebuilt every role from events, and followed each holder to its final key. The result is 73 rows.

Seven protocols showed no upgrade path. Seven need a token vote and a timelock, five a multisig and a timelock. Five can upgrade by multisig with no delay.

None of the pause or freeze powers we found waits on a timelock. At 8 protocols, one key can pull the brake.

At Falcon Finance, one key can burn USDf from any address. At mETH, a six of fourteen Safe can force-burn any balance. Ethena's redistribution waits a day.

Docs and chain disagreed at six of the 25 protocols. A reviewer reading only the docs would have been wrong each time.

Good setups give holders time to leave, limit emergency keys to stopping, give each key one power, and avoid quiet bypasses around the timelock.

Read the full census for every protocol, or talk to Guardian about who holds your admin keys.

On November 2, 2026, SEC staff gave examples of the unilateral authority through which a central party oversees participation. Each is a function in a deployed contract, held by an address anyone can look up.

This census traces who holds the upgrade, pause, freeze, blacklist, mint and burn powers in 25 large protocols, down to the final key.

It is the data companion to our explainer on the SEC's central party test. We do not say whether any protocol is a central party; that is a legal conclusion.

This article explains the technical and security side of the SEC Division of Corporation Finance's FAQ 1.5. It is not legal advice; confirm how it applies to you with counsel.

Method and Limits

Sample. We ranked DefiLlama's protocols by Ethereum TVL on November 4, 2026, grouped under their parent protocol.

We skipped exchange-issued staking tokens, risk curators whose vaults run on sampled protocols, the Tornado Cash mixer, and protocols with no single core contract or address list.

That left 25 protocols ranked 1 to 36, from Lido at $23.6 billion to Symbiotic at $0.31 billion.

Reads. For each protocol we took one to three core contracts from its official docs or deployment registry, and read them at block 26,343,097.

We rebuilt AccessControl roles from grant and revoke events and confirmed each holder with hasRole.

We followed every holder to its final key: an EOA, a Safe, a timelock, a token governor or an immutable contract. Where a function's effect mattered, we read verified source on Sourcify.

Every EOA and every Safe with a threshold of 3 or less was re-checked with Foundry's cast. The result is 73 rows, one per contract and power.

Limits. Mainnet only. Roles granted without events, or powers handed on through contracts outside those we started from, could be missed.

Signer identities, key storage and signing policies are not onchain. Any governance action since the pinned block can change a holder, threshold or delay.

Who Can Change the Code

Whoever can replace a contract's code can, in principle, change what it does with deposits.

Fastest path to a code change	Protocols	Count
No upgrade path in the contracts read	Morpho, Uniswap, Curve (3pool), Convex, Ethena (USDe, sUSDe), StakeWise, Symbiotic	7
Token vote, then a timelock	Lido, Aave, Spark, Sky, Compound, Fluid, Grove	7
Multisig, then a timelock	ether.fi, Kelp, mETH, Maple, Re	5
Operator vote, then a delay	Rocket Pool	1
Multisig, no delay	SSV Network, EigenLayer, Falcon Finance, Pendle, Liquid Collective	5

Three cases show why one read is not enough.

EigenLayer. Its ProxyAdmin belongs to a 1-of-2 Safe whose signers are a 10-day timelock and the 9-of-13 Community Multisig, which can act at once.
Kelp. Proxy upgrades wait 10 days, but the same 6-of-11 Safe can repoint LRTConfig's registered contracts and asset strategies at once.
Ethena. USDe's owner is a 1-day timelock that also lets the 5-of-10 dev Safe run 55 whitelisted functions on 8 contracts with no delay. Changing the USDe minter is not among them.

Emergency Powers Skip the Delay

We found pause, freeze or blacklist powers at 20 of the 25 protocols, and none waits on a timelock. The difference is who can pull the brake.

One key at 8 protocols: EOAs at Ethena, ether.fi, Fluid, Pendle, mETH and Re, and 1-of-N Safes at EigenLayer (1-of-7) and Kelp (1-of-5).
A multisig at 11, from 2-of-3 at Rocket Pool and Liquid Collective to 5-of-9 at Compound and Curve.
A token vote at Sky, where the PSM emergency module we read answers to the current governance spell and skips the 2-day delay.

A single-key pauser is not automatically a weakness. At ether.fi, an EOA guardian can pause the LiquidityPool for one day; an indefinite pause, or an early unpause, needs the 4-of-7 operating Safe.

Powers Over Balances

Three protocols have roles that reach into individual balances. A fourth lets a multisig control a minter outside its timelock.

Falcon Finance. USDf's only minter, a contract, mints any amount to any recipient on a signature from one EOA. The signed message carries a collateral reference that the contract does not check.

A second EOA can burn(from, amount) with no allowance check. A 4-of-6 Safe can freeze any address and upgrade the token.

mETH. A 6-of-14 Safe holds forceMint and forceBurn on any account with no delay, and a second timelock holds them with a 3-day delay.

Ethena. A fully restricted holder's sUSDe can be redistributed, but only through the 1-day timelock.

Re. The reUSD CCIP token pool is a minter owned directly by the 3-of-5 Safe, outside Re's 2-day timelock.

Ethena's docs say its blacklist targets sanctioned, criminal and similar high-risk actors. The chain shows only who can use it.

Every Protocol Checked

Rank is DefiLlama's Ethereum TVL rank on November 4, 2026. Thresholds and delays were read at block 26,343,097.

#	Protocol	Who can change core code	Delay	Fastest emergency or balance power
1	Lido	LDO vote through Dual Governance	4 days	Withdrawal pause: 3-of-6 Safe (single use)
2	Aave V3	AAVE vote, Level 1 executor	1 day	Pause or freeze: 4-of-7 Safe
3	SSV Network	5-of-9 Safe	None	No pause found
4	Spark	SKY vote	2 days	Freeze or pause: 3-of-5 Safe
6	EigenLayer	9-of-13 Safe; usual path a 10-day timelock	None	Pause: 1-of-7 Safe
7	Morpho	Not upgradeable	n/a	No pause; fees set by a 6-of-10 Safe
8	Ethena	Not upgradeable; minter set via timelock	1 day	Blacklist or mint shutoff: one EOA
9	Sky	SKY vote	2 days	PSM halt: SKY vote, no delay
10	ether.fi	6-of-10 Safe via timelock	10 days	1-day pause: one EOA
11	Uniswap	Not upgradeable	n/a	No pause; fee settings by UNI vote
12	Falcon Finance	4-of-6 Safe	None	Mint, and burn from any address: one EOA each
14	Compound V3	COMP vote	2 days	Pause: 5-of-9 Safe
15	Curve	Not upgradeable (3pool)	n/a	crvUSD emergency calls: 5-of-9 Safe
18	Rocket Pool	oDAO vote (9 operators), council veto	7 days	Deposit shutoff: 2-of-3 Safe (security council)
19	Kelp	6-of-11 Safe via timelock (registry: no delay)	10 days	Pause: 1-of-5 Safe
20	StakeWise V3	Not upgradeable	n/a	No pause found
21	Fluid	Token vote	1 day	Token pause: one EOA, via a pause contract
22	Pendle	3-of-5 Safe	None	Pause: any of 6 EOAs
25	Liquid Collective	4-of-7 Safe	None	Pause: 2-of-3 Safe
27	mETH Protocol	6-of-14 Safe via timelock	3 days	Force-burn: 6-of-14 Safe; pause: one EOA
28	Convex	Not upgradeable	n/a	Shutdown: 3-of-5 Safe
29	Re	3-of-5 Safe via timelock	2 days	Pause: one EOA
30	Grove	SKY vote	2 days	Freeze relayers: 2-of-5 Safe
35	Maple	4-of-7 Safe via timelock	3 days	Pause: 3-of-6 Safe; syrupUSDC pool delegate is an EOA
36	Symbiotic	Not upgradeable	n/a	Fees: 2-of-3 Safe

What Good Looks Like

A delay long enough to leave. ether.fi, Kelp and EigenLayer's timelock give holders 10 days. Lido gives 4, which stETH holders can extend through Dual Governance.
Emergency powers that can only stop, like ether.fi's one-day pause, Lido's single-use CircuitBreaker and Ethena's off-only gatekeepers.
One power per key. At Aave, upgrades need an AAVE vote; a 4-of-7 Safe holds only emergency switches, and a 5-of-9 Safe can only cancel queued payloads.
No quiet bypass. A fast path around the timelock, as at EigenLayer or Kelp, belongs with a large, documented signer set.

Check your own protocol

Docs and chain disagreed at six protocols: Morpho, Ethena, EigenLayer, mETH, Curve and Re. Morpho documents a 5/9 governance multisig; it is 6-of-10.

A reviewer reading only the docs would have been wrong each time. So read the chain:

Read the EIP-1967 implementation slot (0x3608…2bbc) and admin slot (0xb531…6103), and call owner().
Rebuild AccessControl roles from RoleGranted and RoleRevoked events, and confirm each holder with hasRole.
Classify each holder. Empty code is an EOA, getThreshold means a Safe (read its modules and guard), and getMinDelay a timelock (find any role that skips its delay).
Flag any function that mints, burns from an address, moves balances or repoints contracts.
Compare with your docs, and repeat after every governance action.

For a fuller review, see our DeFi protocol due diligence checklist.

How Guardian Helps

Guardian's Risk Monitoring tracks who holds owner, pauser, upgrader and parameter rights on each contract you deploy. It compares timelocks, thresholds and pause state against the reviewed configuration and surfaces upgrades as they land.

For allocators, Guardian's capital allocator diligence covers who can upgrade, pause or drain a position.

Frequently Asked Questions

Can an admin key take tokens from DeFi users?

At three protocols a role reaches individual balances: Falcon Finance (USDf burn-from, one EOA), mETH (force-burn, 6-of-14 Safe) and Ethena (sUSDe redistribution, after a 1-day timelock). An upgrade with no delay could also change what a contract does with deposits.

Who usually holds DeFi admin keys?

Multisigs. Counting the weakest holder of each of the 72 live powers, Safes held 31, token governance with a timelock 13, EOAs 10, and timelocks with a multisig proposer 8. No EOA held an upgrade path.

Does a multisig or timelock decide whether a protocol is a central party?

No. FAQ 1.5 turns on unilateral authority and excludes discretion exercised solely through broad-based governance. Whether a given holder makes a central party is a legal question, and the FAQs are staff views with no legal force.

Sources

Know who holds your admin keys

Guardian tracks who holds owner, pauser and upgrader rights on your contracts, which of them are EOAs rather than multisigs, and surfaces upgrades as they land.

Talk to Guardian Explore Risk Monitoring