Census · updated 2026-10-30
How the whole population actually looks.
Every single-address check is free and copyable. What is not copyable is the population: this is a live census of 2957 EIP-1967 proxies across 7 chains, with every observation kept. 418 of them leave upgrade authority on a single key — 22.58% of those whose controller is discoverable. Counted by controller, not by storage slot: UUPS proxies keep authority inside the implementation, and a slot-only count missed 359 of them.
Headline
Single-key admins, by chain
| Chain | Candidates | Proxies | Single-key | Single-key rate |
|---|---|---|---|---|
| ethereum via explorer | 600 | 591 | 89 | 23.06% |
| optimism via explorer | 600 | 584 | 91 | 28.09% |
| gnosis via explorer | 600 | 363 | 60 | 17.09% |
| scroll via explorer | 487 | 486 | 119 | 36.39% |
| celo via explorer | 468 | 468 | 25 | 10.37% |
| mode via explorer | 470 | 436 | 31 | 14.22% |
| arbitrum via logs | 30 | 29 | 3 | 75% |
| Combined | 3255 | 2957 | 418 | 22.58% |
Single-key counts any proxy whose upgrade controller is one externally-owned account — whether it sits in the admin slot, behind a UUPS implementation, or on a beacon. The denominator is proxies whose controller we could actually read; ones we could not are excluded rather than assumed safe. 27 candidates were not proxies; 271 could not be read.
Effective control · depth-2
Who actually owns the admin?
The table above counts the controller we read directly. A proxy whose admin is a contract is usually read as “multisig / timelock — safer”, but that is a statement about the admin's shape, not about who can act. Here we follow one level further — proxy → admin → owner() — and ask whether the admin is itself owned by a single externally-owned account. 758 proxies are single-key for exactly that reason, on top of the 418 already single-key at the slot / implementation level.
| Chain | Controller resolved | Single-key | Effective rate | Ceiling |
|---|---|---|---|---|
| ethereum | 357 | 232 | 64.99% | 66.12% |
| optimism | 288 | 181 | 62.85% | 64.57% |
| gnosis | 258 | 226 | 87.6% | 87.6% |
| scroll | 320 | 250 | 78.13% | 78.26% |
| celo | 238 | 135 | 56.72% | 56.9% |
| mode | 222 | 149 | 67.12% | 67.26% |
| arbitrum | 3 | 3 | 100% | 100% |
| Combined | 1686 | 1176 | 69.75% | 70.28% |
Rate = single-key ÷ the proxies whose effective controller we could actually resolve (1686), so it is a floor: 30 admin contracts returned no readable owner and are excluded rather than assumed safe. The ceiling is where the rate would land if every unresolvable admin also turned out to be single-key. Method: owner() (falling back to admin()) on the admin contract via public RPC, selectors derived from our own keccak rather than hard-coded. Resolved 2026-10-30.
Concentration
Where the single-key admins live
The rate is not a property of the ecosystem. It is a property of which contract pattern you look at.
| Contract name | Scanned | Proxies | EOA admin | Contract admin |
|---|---|---|---|---|
| TransparentUpgradeableProxy | 1200 | 1163 | 23 | 1139 |
| ERC1967Proxy | 1195 | 1160 | 0 | 0 |
| AdminUpgradeabilityProxy | 830 | 605 | 36 | 145 |
| Upgraded(address) | 30 | 29 | 0 | 1 |
Why this exists
The reading is free. The population isn't.
- Anyone can read one contract. The method is public and the free checker hands it to you. That is not the product.
- Nobody can read the population alone. “Is my surface normal?” needs everyone else measured. That aggregate is what we keep.
- It compounds. Today's state can be copied tomorrow; today's record cannot be reconstructed. Every run is appended, never overwritten.
- It is verifiable. The numbers here come from public data, and the scripts to re-derive them are MIT.
Limits
What this census is not
Not a random census. Candidates come from three exact contract names via the public Blockscout API. A random sample of all verified proxies could shift every figure.
Ordering and platform bias. The draw over-represents newer and Blockscout-indexed deployments. Base enumeration has historically been explorer-gated, which is a single point of failure for that chain.
“No admin slot” conflates safe and unknown. Renounced, UUPS-by-design, and a non-standard authority slot are not distinguished by this method. UUPS and renounced labels are clearly-marked heuristics.
Monitoring and analysis, not advice. Not an audit, not insurance, not legal, financial, or investment advice.