Who can still change this contract?
Paste-free answers for 58 widely-used contracts. For each one: can the code be replaced, who holds the key that replaces it, what the privileged role can still do to holders — and whether a live bug bounty pays for finding a hole in it. Every claim links to the evidence it came from.
See what changed → — the same 58 contracts are re-read every day and diffed against the day before, so an implementation swap or an owner moving to a different key shows up with its before and after. RSS.
Why this exists: a block explorer shows you a storage slot. It does not tell you that the address in it is a plain wallet, that the wallet can mint, and that a live program pays six figures for a bug in the same code. Those facts sit in four different places. Here they sit in one.
Reading the Powers column: the first number is capabilities the contract’s own
published interface declares. The second, marked +n?, is selectors found in the compiled code
that were not confirmed by a source — a swap router shows mint there because it
calls mint on a pool, not because it can mint. The two are never added together.
| Contract | Upgradeable | Admin | Powers (confirmed + unconfirmed) | Bounty |
|---|---|---|---|---|
| Base15 contracts | ||||
AERO0x9401…8631 | not found | none found | 2 | — |
Aerodrome Router0xcf77…4e43 | not found | none found | 0 +1? | — |
BRETT0x532f…42e4 | not found | none found | 4 | — |
cbBTC0xcbb7…33bf | Yes | single key | 7 | — |
cbETH0x2ae3…ec22 | Yes | contract | 3 | — |
Compound III cUSDCv3 (Base)0xb125…eb2f | Yes | contract | 3 | — |
DEGEN0x4ed4…efed | not found | contract | 4 | — |
L2StandardBridge0x4200…0010 | Yes | contract | 1 +2? | — |
Morpho Blue0xbbbb…ffcb | not found | contract | 2 | yes |
OptimismMintableERC200x0b3e…7e1b | not found | none found | 3 | yes |
Uniswap V3 Factory (Base)0x3312…fdfd | not found | contract | 1 | yes |
USDbC0xd9aa…b6ca | Yes | contract | 3 | — |
USDC (Base)0x8335…2913 | Yes | single key | 7 | — |
WELL (Moonwell)0xa885…96ae | Yes | contract | 4 | — |
WETH (Base)0x4200…0006 | not found | none found | 0 | — |
| Ethereum35 contracts | ||||
AAVE0x7fc6…dae9 | Yes | contract | 1 | yes |
Aave v3 Pool0x8787…a4e2 | Yes | none found | 3 | — |
Compound III cUSDCv30xc3d6…cdc3 | Yes | contract | 3 | — |
CRV0xd533…cd52 | not found | contract | 1 | — |
crvUSD0xf939…1b4e | not found | none found | 2 | — |
Curve 3pool0xbebc…f1c7 | not found | contract | 0 +2? | — |
DAI0x6b17…1d0f | not found | none found | 3 | — |
EigenLayer StrategyManager0x8586…075a | Yes | contract | 4 | — |
ENS Registry0x0000…2e1e | not found | none found | 1 | — |
FRAX0x853d…b99e | not found | none found | 2 | — |
GHO0x40d1…6c2f | not found | none found | 2 | — |
LDO0x5a98…1b32 | not found | none found | 2 | — |
Lido Withdrawal Queue0x889e…f9b1 | Yes | contract | 3 | — |
LINK0x5149…86ca | not found | none found | 0 | — |
MakerDAO Vat0x35d1…492b | not found | none found | 5 | — |
MKR0x9f8f…79a2 | not found | none found | 4 | — |
PEPE0x6982…1933 | not found | none found | 2 | — |
Permit20x0000…8ba3 | not found | none found | 0 | — |
PYUSD0x6c3e…a0e8 | Yes | single key | 7 | — |
rETH0xae78…6393 | not found | none found | 1 | — |
Safe singleton 1.4.10x4167…461a | not found | none found | 1 | — |
Seaport 1.60x0000…b395 | not found | none found | 0 | — |
SHIB0x95ad…c4ce | not found | none found | 0 | — |
stETH0xae7a…fe84 | Yes | none found | 2 | yes |
sUSDe (Ethena)0x9d39…3497 | not found | contract | 5 | — |
TUSD0x0000…b376 | Yes | contract | 6 | — |
UNI0x1f98…f984 | not found | none found | 2 | — |
Uniswap V2 Router 020x7a25…488d | not found | none found | 0 +1? | yes |
Uniswap V3 Factory0x1f98…f984 | not found | contract | 1 | yes |
USDC0xa0b8…eb48 | Yes | single key | 7 | — |
USDe (Ethena)0x4c9e…68b3 | not found | contract | 4 | — |
USDT0xdac1…1ec7 | not found | contract | 6 | — |
WBTC0x2260…c599 | not found | contract | 4 | — |
WETH90xc02a…6cc2 | not found | none found | 0 | — |
wstETH0x7f39…2ca0 | not found | none found | 0 | — |
| Polygon8 contracts | ||||
Aave v3 Pool (Polygon)0x794a…14ad | Yes | none found | 3 | — |
QuickSwap Router0xa5e0…78ff | not found | none found | 0 +1? | yes |
USDC (native, Polygon)0x3c49…3359 | Yes | single key | 7 | — |
USDC.e (bridged)0x2791…4174 | Yes | none found | 5 | — |
USDT (Polygon)0xc213…8e8f | Yes | none found | 3 | — |
WBTC (Polygon)0x1bfd…bfd6 | Yes | none found | 2 | — |
WETH (Polygon)0x7ceb…f619 | not found | none found | 1 | — |
WPOL / WMATIC0x0d50…1270 | not found | none found | 0 | — |
Nothing in the registry matches . This list is 58 contracts across Base, Ethereum and Polygon — it is a fixed set, not a search engine. Check any other address → $5.
The whole table as data
Free, no key, CC0: /c/index.json —
and one file per contract at /c/<chain>/<address>.json with the full evidence.
For an address that is not on this list: a page for any contract, $5 — or the same data per call for software, $0.05.
Ask it from inside your AI assistant
This table is also an MCP server, so Claude, Cursor or any
MCP client can answer “who can still change this contract?” without leaving the chat. No API key, no account.
Nothing to install — point your client at the hosted endpoint:
claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp
Or run it locally over stdio: npx -y github:ofirbaranesad-agent/contract-powers-mcp —
source and setup on GitHub.
Both transports carry the same four tools, imported from the same file.
What this is not
It is not an audit and there is no safety score here — deliberately. A score invites you to stop reading, and the interesting part is always which power, held by whom. Upgradeable is not a synonym for dangerous: most large protocols are upgradeable on purpose. What matters is who holds the key and what stands between them and your balance.