OneKeyAway

Who can change the contracts your money sits in?

Paste any EVM contract or Safe. OneKeyAway reads its proxy admin, owner and admin roles and follows them through ProxyAdmins, Safes and timelocks down to the keys that sign.

Free No signup 13 EVM chains in the browser check

Who controls this contract?

Runs in your browser over public RPC

Reads EIP-1967 slots, owner(), Safe signers and timelock delays. We log page views and the chain and address checked, to count usage. No cookies.

Single key Upgradeable: yes
Example: USDC on Base, read 2026-10-06
PowerHeld byKey setup
Proxy adminCan replace all the code0x4fc7850364958d97b4d3f5a08f79db2493f8ca44Single key EOA (one signer, no on-chain multisig)
owner()Owner-only functions0x3abd6f64a422225e61e435bae41db12096106df7Single key EOA (one signer, no on-chain multisig)

Press Check to read it live, or paste another address. The full control path adds every AccessControl role, Safe signers and timelock delays.

Check a whole protocol

Up to 12 contracts per protocol

Contracts come from DefiLlama's open-source TVL adapters (585 protocols indexed). The list can include third-party tokens a protocol holds, such as USDC, so check the name column.

What we found

Public on-chain facts. Every address links to a block explorer so you can check it.

At least 35 protocols and token issuers have a core or fund-holding contract whose upgrade path ends at one EOA, with no on-chain multisig and no timelock. We read the control path of about 2,000 contracts from about 480 protocols, using addresses from DefiLlama's open-source TVL adapters. Each hit was then checked by hand, and we dropped third-party tokens and factories that can't touch existing funds. We contact each team privately before we publish contract-level rows.

Recently launched DeFi

10 of the 125 protocols listed in the last 12 months, including a ~$157M stablecoin wrapper, a ~$142M BTC yield vault and a perps bridge that holds user deposits.

BTC and stablecoin yield

Several vault and receipt tokens backing $100M-$300M protocols.

Tokenised assets

USDC, PYUSD, USDtb, BUIDL-I and several tokenised fund shares are upgradeable by a single EOA. These issuers almost certainly keep that key in an HSM, which is the point: the safety lives off-chain, where nobody else can see it, and there is no timelock that would give holders warning.

The data

Free admin-change alerts

Up to 3 contracts or Safes per email address

Get an email when a contract you depend on changes hands. A hosted stand-in for OpenZeppelin Defender Monitor's admin alerts, which shut down on 2026-07-01.

Paused for now: the change checks are not running at the moment. You can still sign up and confirm, and your contracts are checked once they restart.

  • An email when the contract is upgraded, changes proxy admin, owner or DEFAULT_ADMIN_ROLE holder, or when a Safe threshold or signer set behind those changes
  • Watch your own Safe too: signers, threshold, modules, guard, fallback handler and singleton (the Bybit attack swapped the singleton)
  • Morpho vaults: also a change of the vault timelock
  • Double opt-in, one-click stop

Why it matters

In the first eight months of 2026, DeFi lost at least $1.3B to hacks, and leaked private keys and admin access overtook smart contract bugs as the top cause (source). Wasabi Protocol lost about $4.5M in April because one deployer EOA could upgrade everything (CoinDesk).

An audit checks the code. It doesn't tell you who can replace it tomorrow. OneKeyAway reads who holds those powers on-chain and can email you if any of that changes.

For AI agents: x402 API and MCP

HTTP 402 USDC on Base or Arbitrum

People use the checks above for free. Agents and integrators can get the same control-path read as JSON, paid per call over x402 in USDC on Base or Arbitrum, with no API key or signup. Bad input is rejected before payment; error responses are never settled.

EndpointWhat it returnsPrice
GET/api/control?chain=&address=Full on-chain control path of a contract$0.01USDC
GET/api/safe?chain=&address=Safe signers, threshold, modules, guard$0.01USDC
GET/api/vault?chain=&address=Morpho vault owner/curator keys and timelock$0.01USDC
GET/api/upgradeable?chain=&address=Is it upgradeable, and by what kind of key$0.001USDC
GET/api/preview?chain=&address=Free verdict onlyFree
POST/mcpRemote MCP server (Streamable HTTP). Tools: control_map(chain, address), watch_contract(email, chain, address). 100 calls/dayFree
Add the MCP server 
$ claude mcp add --transport http onekeyaway https://onekeyaway.appin60.com/mcp
The first request returns 402 and a price 
$ curl -i "https://onekeyaway.appin60.com/api/control?chain=8453&address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

Discovery

Payment

Protocol
x402 v2, scheme exact
Networks
Base eip155:8453, Arbitrum One eip155:42161
Asset
USDC
MCP
https://onekeyaway.appin60.com/mcp

Questions

Something else? Email us.

Is this an audit?

No. We don't review your code logic. We map who holds the power to change it, which is the cause of most 2026 losses.

Why publish this data?

Everything in it is readable on-chain by anyone, attackers included. Publishing it lets users and teams see it too. If your protocol is listed and you have fixed it, email us and we'll update the row. If you think a row is wrong, tell us and we'll correct it.

How does the free checker work?

It runs in your browser: it reads EIP-1967 slots, owner(), Safe getThreshold()/getOwners() and timelock delays over public RPC nodes. View the page source to see every call. The full control path comes from our server, limited to 20 a day per IP address.

Does "single key" mean a hot wallet?

No. It means one EOA, one on-chain signer with no multisig and no delay. That key may sit behind MPC or an HSM, which can't be checked on-chain, but a compromised signer could still act instantly.