Governance and admin keys: who can change the rules

Governance and admin key risk is the possibility that the rules governing already-deposited funds are changed by whoever holds the authority to change them. Very few systems are genuinely immutable; most retain the ability to upgrade contracts, adjust parameters, pause activity, redirect fees or mint units. That authority is not inherently a defect, since it is also what allows a live defect to be fixed, but it is always a dependency on a specific set of people or votes.

The spectrum from fixed to fully mutable

At one end sit contracts with no owner and no upgrade path, where the behavior deployed is the behavior forever and a discovered defect can only be escaped by withdrawing. At the other sit systems where a single key can replace the implementation instantly, which means every deposit is effectively a bet on the holder of that key. Between them are the common arrangements: a multisignature wallet requiring several approvals, a delay contract that publishes a queued change and enforces a waiting period before it executes, and on-chain voting by holders of a governance token. Each constraint is real and each has a specific limit. A delay only protects users who are watching, understand the queued change, and can withdraw within the window. A multisignature threshold only helps if the signers are genuinely independent, which is a question about people and organizations rather than about contracts.

What these powers usually include

• Upgrade. Replace the logic behind a proxy, which can change any rule at once. This is upgradeability risk in its most direct form.
• Parameters. Adjust collateral factors, interest curves, fees, caps and which assets are accepted, all of which move economic outcomes without touching the code.
• Pause and unpause. A protocol emergency pause can stop a drain in progress and can equally prevent withdrawals when users most want them.
• Value routing. Turn a fee switch on or off, change the recipient address, or spend from the protocol treasury.
• Issuance. Mint new units, authorize new emissions, or extend a schedule that was presented as fixed.

How governance itself is attacked

A governance attack uses the legitimate process to produce an illegitimate outcome, which makes it awkward to defend against and awkward to reverse. The mechanisms are well documented. Voting power can be acquired on the market, and in systems that count tokens at the moment of voting rather than at an earlier snapshot it can be borrowed, including within a single transaction using a flash loan. Participation is usually low, so a quorum can be reached by a small group of large holders whose interests may diverge from users. Delegation concentrates voting power in a handful of delegates, making the practical electorate far smaller than the holder count implies. And a proposal's on-chain payload can differ from its description, so what passes is what the calldata does rather than what the forum post said.

The economics of the attack are worth stating explicitly, because they explain why smaller systems are the ones affected. The cost of acquiring control is set by the market value of the voting token, while the prize is the value the system controls, which includes deposits and treasury assets. Where the second is large relative to the first, the trade is profitable at any level of technical skill, and no defect in the code is required. Vote-buying markets, which let a holder rent out voting power without selling the underlying position, lower the cost further by separating the vote from the exposure to the consequence.

The conflict that governance cannot resolve

Token holders and users of a protocol are frequently not the same people and do not want the same things. Higher fees benefit holders if a fee switch routes value to them and cost users directly. Loosening collateral requirements grows deposits and increases the chance of bad debt. Spending the treasury on incentives raises reported activity and dilutes existing holders. None of these tensions is a scandal; they are the ordinary politics of a system where the parties with formal power are not the parties bearing the operational risk. The relevant point for research is that they make future policy genuinely uncertain in a way corporate charters usually do not.

Why this makes cash-flow style ratios provisional

When a protocol's revenue figures are compared to its market value, the comparison quietly assumes the current policy persists. It usually can be changed by a vote. A fee switch that currently sends nothing to holders can be turned on, and one that currently does can be turned off; emissions can be extended; the treasury can be spent. This is a real difference from an equity, where a dividend is a board decision but the residual claim on assets and earnings is a legal right that survives it. A digital asset holder generally has a governance vote and no enforceable claim on cash flows at all. So figures such as 30-day revenue and holder revenue yield describe what a system did under a policy in force during that window, not an entitlement, and a governance vote can change the input tomorrow without anything in the market moving first.

What is worth establishing

For any system holding meaningful value: whether contracts are upgradeable and by which address; whether that address is a single key, a threshold of independent signers, or a vote; whether a delay applies and how long it is; who can pause, and whether a pause blocks withdrawals; the distribution of voting power among the largest holders and delegates; and whether emergency powers have been used before and for what. Concentration measures such as the Nakamoto coefficient capture part of this at the network layer, though nothing summarizes protocol-level control in one number.

Custody, the subject of the next article, asks the same question one layer down: who holds the key, and what happens if they fail. The risk section records governance and upgrade characteristics per protocol, and the glossary defines each of the powers named above.