Lido Withdrawal Queue

0x889edc2edab5f40e902b864ad4d7ade8e412f9b1 on ethereum

In one line: upgradeable proxy (eip1967.implementation); retained powers: ownership, pause; bytecode contains SELFDESTRUCT.

UpgradeableYes

Source verifiedYes

Controlled byA contract

Confirmed powers2

Can this code be replaced?

Yes — this is a proxy. The address you interact with holds no logic of its own; it forwards calls to a second contract. Whoever holds the upgrade right can point it somewhere else, and every behaviour described on this page changes with it.

Pattern	`eip1967.implementation`
Current logic	`0xe42c659dc09109566720ea8b2de186c2be7d94d9`
Logic name	WithdrawalQueueERC721
Logic source verified	Yes

Raw storage evidence (2)

eip1967.implementation → 0xe42c659dc09109566720ea8b2de186c2be7d94d9
eip1967.admin → 0x3e40d73eb977dc6a537af587d48316fee66e9c8c

Who holds the keys?

Owner / admin	`0x3e40d73eb977dc6a537af587d48316fee66e9c8c`
Found via	`eip1967.admin slot`
That address is	A contract

owner is a contract — could be a multisig or timelock; this endpoint does not verify which. It could be a multisig, a timelock, or a single-key wrapper — this registry does not open it. Follow the link above to see what that contract can do.

What the privileged role can still do

Each card is a capability found in the code. declared = the contract’s published interface exposes it. bytecode-heuristic = the 4-byte selector appears in the compiled code, which often means the contract implements it — but it can equally be a function this contract calls on another contract. Only a verified source settles that.

Control can be transferred

declared

The privileged role itself can be handed to another address, or renounced.

Evidence (4)

grantRole(bytes32,address) implementation-abi
revokeRole(bytes32,address) implementation-abi
revokeRole(bytes32,address) implementation-bytecode
grantRole(bytes32,address) implementation-bytecode

Transfers can be halted

declared

A privileged role can stop activity, including your ability to exit.

Evidence (2)

pauseFor(uint256) implementation-abi
pauseUntil(uint256) implementation-abi

Is there a bug bounty on this?

No live bug-bounty program matched this contract’s name in my index (186 Immunefi + 52 Cantina programs, rebuilt daily). Matching is by name, not by address — a program can cover this contract without the names lining up. Browse the full index at Bounty Radar.

Raw facts

Chain	ethereum (chainId 1)
Contract name	OssifiableProxy
Compiler	`v0.8.9+commit.e5eed63a`
License	—
Bytecode size	2,497 bytes (logic: 24,190)
DELEGATECALL	present
SELFDESTRUCT	present
CREATE2	absent
Explorer	view on block explorer ↗

How this was produced, and what it cannot tell you

Storage slots, bytecode and eth_call results were read from public RPC nodes; where the source is verified, the published interface was read too. Nothing here is copied from another site’s opinion. Generated in 1346 ms on 2026-08-29.

confidence="declared" means the ABI exposes the function. confidence="bytecode-heuristic" means the 4-byte selector appears in the code — usually its own dispatch table, but it can also be a selector this contract CALLS on another contract. Only a verified ABI settles it.
admin.ownerType="contract" does not mean multisig — this endpoint does not inspect the owner contract.
bounty.match="name-heuristic" matches a contract NAME to a program name; it is not proof the address is in scope.

What would change the answer: an upgrade after the date above; a power reachable only through a contract this one trusts; or role-based access control, whose holders this registry does not enumerate. Re-read the chain before you rely on it.

Machine-readable

Same facts as JSON, free, no key: /c/ethereum/0x889edc2edab5f40e902b864ad4d7ade8e412f9b1.json. Live lookups for any address (not just this list) are $0.05 per call.

Want a human-grade read?

This page is automated pattern-matching. If you need someone to actually read the code and tell you what breaks, I do fixed-scope micro-audits — you pay after you read the report.