Admin Key Risk
The risk created when a small group holds keys able to change, pause, or drain a protocol that presents itself as automatic.
Most deployed protocols retain privileged functions: upgrading the implementation, pausing transfers, changing fee parameters, setting the oracle address, or moving treasury assets. Whoever holds those keys can, in principle, do those things, so the protocol's guarantees are bounded by the security and independence of that key set. Common mitigations are a multi-signature wallet requiring several independent signers, timelocks that publish a change before it can take effect, splitting powers so that pausing and upgrading sit with different holders, and eventually renouncing the ability to upgrade. Users can see the current owner address and its threshold on-chain, which is the practical way to check what a given protocol's operators could still do.
Dalam praktik
A protocol described as immutable may still have an owner address able to change the oracle it reads, which is functionally equivalent to being able to reprice every position.
Kesalahpahaman yang umum terjadi
That a multi-signature wallet removes admin key risk, when it distributes rather than eliminates it and fails entirely if signers share devices, an employer, or a jurisdiction.