Census · updated 2026-10-18
How the whole population actually looks.
Every single-address check is free and copyable. What is not copyable is the population: this is a live census of 2941 EIP-1967 proxies across 7 chains, with every observation kept. 310 of them leave upgrade authority on a single key — 19.34% of those whose controller is discoverable. Counted by controller, not by storage slot: UUPS proxies keep authority inside the implementation, and a slot-only count missed 217 of them.
Headline
Single-key admins, by chain
| Chain | Candidates | Proxies | Single-key | Single-key rate |
|---|---|---|---|---|
| ethereum via explorer | 600 | 589 | 146 | 35.7% |
| optimism via explorer | 600 | 588 | 126 | 35.9% |
| gnosis via explorer | 600 | 369 | 0 | 0% |
| scroll via explorer | 481 | 480 | 3 | 1.46% |
| celo via explorer | 468 | 467 | 30 | 12.2% |
| mode via explorer | 443 | 433 | 5 | 2.5% |
| arbitrum via logs | 15 | 15 | 0 | — |
| Combined | 3207 | 2941 | 310 | 19.34% |
Single-key counts any proxy whose upgrade controller is one externally-owned account — whether it sits in the admin slot, behind a UUPS implementation, or on a beacon. The denominator is proxies whose controller we could actually read; ones we could not are excluded rather than assumed safe. 22 candidates were not proxies; 244 could not be read.
Effective control · depth-3
Who owns the admin's admin?
The map above follows the controller one level; depth-2 follows the admin contract to its owner. But an admin contract that is itself a contract is not automatically safer: it can be an owner()→EOA in disguise or a 1-of-1 Gnosis Safe, and both are single-key. Following one level further finds 42 more single-key proxies — 16 owned through an EOA and 26 a 1-of-1 Safe. So of the 1579 candidate proxies, 1088 are confirmed single-key and 15 stay unclassifiable: the share is between 68.9% and 69.85% — the depth-2 figure of 67.31% understated it, because depth-2 counted every contract-owned admin as multi-key.
| Chain | Controller resolved | Single-key | Rate (classified) | Lower bound | Ceiling |
|---|---|---|---|---|---|
| ethereum | 398 | 286 | 71.86% | 70.44% | 72.41% |
| optimism | 330 | 227 | 68.79% | 68.37% | 68.98% |
| scroll | 203 | 137 | 67.49% | 66.83% | 67.8% |
| celo | 243 | 140 | 57.61% | 57.38% | 57.79% |
| mode | 199 | 134 | 67.34% | 67% | 67.5% |
| gnosis | 191 | 164 | 85.86% | 85.42% | 85.94% |
| Combined | 1564 | 1088 | 69.57% | 68.9% | 69.85% |
Bounds are over all 1579 candidate proxies (the denominator): the lower bound counts every unclassifiable cell as non-single-key, the ceiling counts every one as single-key. Among the 1564 cells whose final authority we could classify, 1088 are single-key (69.57%). Method: owner() (falling back to admin()) one level past the admin contract, plus Gnosis Safe getThreshold()/getOwners() and TimelockController getMinDelay(), over public RPC, selectors derived from our own keccak. When owner() reverts, the admin contract's own Safe/timelock surface is read instead (and a zero owner() is recorded as renounced), so a cell is only left unclassifiable when none of those read. Two-height rule: every classification is re-read 128 blocks back; a class that does not reproduce is a read flake, not a change (agreement: ethereum 260/260, optimism 206/206, gnosis 192/192, scroll 202/202, celo 214/214, mode 195/195). Resolved 2026-10-21.
Concentration
Where the single-key admins live
The rate is not a property of the ecosystem. It is a property of which contract pattern you look at.
| Contract name | Scanned | Proxies | EOA admin | Contract admin |
|---|---|---|---|---|
| TransparentUpgradeableProxy | 1200 | 1187 | 55 | 1131 |
| ERC1967Proxy | 1174 | 1149 | 0 | 0 |
| AdminUpgradeabilityProxy | 818 | 590 | 38 | 138 |
| Upgraded(address) | 15 | 15 | 0 | 0 |
Why this exists
The reading is free. The population isn't.
- Anyone can read one contract. The method is public and the free checker hands it to you. That is not the product.
- Nobody can read the population alone. “Is my surface normal?” needs everyone else measured. That aggregate is what we keep.
- It compounds. Today's state can be copied tomorrow; today's record cannot be reconstructed. Every run is appended, never overwritten.
- It is verifiable. The numbers here come from public data, and the scripts to re-derive them are MIT.
Limits
What this census is not
Not a random census. Candidates come from three exact contract names via the public Blockscout API. A random sample of all verified proxies could shift every figure.
Ordering and platform bias. The draw over-represents newer and Blockscout-indexed deployments. Base enumeration has historically been explorer-gated, which is a single point of failure for that chain.
“No admin slot” conflates safe and unknown. Renounced, UUPS-by-design, and a non-standard authority slot are not distinguished by this method. UUPS and renounced labels are clearly-marked heuristics.
Monitoring and analysis, not advice. Not an audit, not insurance, not legal, financial, or investment advice.