Admin keys and immutability

Wonder

1. What is a mint authority, and what does it let its holder do?
2. Why can an upgradeable proxy be both a safety feature and a backdoor?
3. If removing admin keys eliminates attacks but also prevents fixes, who decides which risk a community accepts?

Explore

Part IAdmin keys: the root of contract theft

1. Many rug pulls trace to a retained power. A mint authority lets its holder print unlimited tokens and sell them into the market at will. A freeze authority or blacklist blocks specific holders from moving their balance. An owner-settable tax can raise the sell fee to one hundred percent, trapping liquidity in place. Each of these is a key someone holds, and each can be turned against the very people it was meant to serve.
2. Upgradeable proxies separate storage from logic: state lives in one address while code executes from another that an admin can swap at any time. This enables patches when bugs are found, but it also means the rules of a token can change retroactively for every holder. In DeFi exploits, proxy upgrades have been abused to redirect funds or alter protocol behavior after deployment. The Squid Game token (November 2021) shows where retained control leads: its contract let anyone buy but stopped ordinary holders from selling, and when its creators cashed out the price fell to almost nothing within minutes.
3. The trade-off is structural. Remove the mint key and no one can print extra tokens; remove the withdrawal path from pool liquidity and no one can pull the reserves out. The cost is that no developer, auditor, or community member can fix a bug, respond to an emergency, or adjust parameters when conditions change. In a permissionless market, every admin power is simultaneously an attack surface and a maintenance tool. Which side it serves depends on whether the key holder acts in good faith and keeps the key safe.
4. Wallet-layer defenses cannot substitute for contract-level design. A user can revoke token approvals, avoid signing unknown transactions, and verify contract addresses before interacting, but these practices do nothing against a mint authority that is actively being used or a proxy upgrade that changes the rules mid-trade. In SPL tokens the mint authority is always set at creation and stays until set to None; the freeze authority is optional and, if omitted, can never be added. Either way, a live authority works regardless of user caution.
5. OpenZeppelin’s proxy documentation makes the architecture explicit: an implementation contract holds the logic, while a proxy keeps the state and forwards every call to it with delegatecall. Upgrading means pointing the proxy to a new implementation address. This is how teams ship fixes, but it also means that any holder of the upgrade authority can replace the entire rule set in a single transaction. The distinction between a patch and a theft is purely behavioral, not technical.
6. Inspecting a token’s contract reveals which keys are live. On an EVM chain, check the contract for an owner role and whether it sits behind an upgradeable proxy; on Solana, check the mint and freeze authorities and any Token-2022 extensions such as a permanent delegate, transfer hook or transfer fee. Each power that is absent or revoked removes its attack class. The remaining risk shifts to people: phishing, impersonation, and social manipulation operate outside the code entirely.

Part IIImmutability and the absence of admin keys

7. Many smart contracts can be changed after launch. On Solana, programs are upgradeable by default through an ‘upgrade authority’ key; on EVM chains like Ethereum, contracts are immutable unless built with proxy patterns that forward execution to a replaceable implementation contract. This design allows for bug fixes and feature additions, but it also means the code users interact with today may not be the same code they read yesterday.
8. The risk of mutability is concentrated trust. If a developer holds an admin key, they can theoretically alter token supply, freeze user accounts, or drain liquidity pools at any moment. This creates a ‘god mode’ that contradicts the decentralized ethos of blockchain. When The DAO was hacked in June 2016, the Ethereum community debated whether to hard fork to reverse the theft—a move that split the chain into Ethereum and Ethereum Classic. That event highlighted how even network-level changes carry profound governance risks.
9. Immutability eliminates this risk entirely. By revoking all administrative authorities—such as the mint, freeze and program upgrade authorities on Solana, or by deploying without proxies or owner roles on EVM chains—the contract becomes a sealed vault. No one can change the rules after deployment. The live code can be checked, once, against the audited code, and stays that way. This removes the threat of insider abuse but also freezes any potential bugs in place permanently.
10. The cost of immutability is permanence. If a critical bug exists, there is no patch; only a migration to a new contract or a network fork can address it. This raises the stakes for pre-launch verification. Teams must invest heavily in formal verification, extensive fuzz testing, and multi-party audits before deployment. The burden shifts from post-launch maintenance to pre-launch rigor. A single overlooked edge case becomes a permanent feature of the system.
11. Bitcoin serves as the reference point for ‘credible neutrality.’ Its rules change only through broad consensus among thousands of independent nodes, not by a single entity. No admin key exists that can alter the block reward or transaction validity. That rigidity is a large part of why many regard Bitcoin as credibly neutral: no single party can rewrite its rules.
12. For token designers, choosing immutability signals a commitment to transparency. Users can verify that the deployed code cannot change. However, this choice requires accepting that mistakes are irreversible. The trade-off is clear: gain predictability that users can verify, or retain flexibility at the cost of introducing a single point of failure and potential abuse.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• Solana Program Library, SPL Token documentation
• OpenZeppelin, 'Proxy Upgrade Pattern' documentation
• Contemporary reporting on the Squid Game token collapse (November 2021)
• Chainalysis, Crypto Crime Report (2024)
• Solana documentation: deploying programs (upgrade authority)
• V. Buterin, 'Credible Neutrality as a Guiding Principle' (2020)