OneKeyAway · on-chain admin-key exposure checks

Is your protocol one stolen key away from a drain?

In the first eight months of 2026, DeFi lost at least $1.3B to hacks, and leaked private keys and admin access overtook smart contract bugs as the top cause (source). Wasabi Protocol lost about $4.5M in April because one deployer EOA could upgrade everything (CoinDesk, Halborn).

An audit checks the code. It doesn't tell you who holds the keys. OneKeyAway does that: for any contract it reads the proxy admin, the beacon and owner(), and it follows ProxyAdmins and Safes down to the keys that actually sign.

Free check: who controls this contract?

Runs in your browser over public RPC. We only log the chain and address checked, to count usage.

Free check: a whole protocol

Reads up to 12 contracts per protocol, taken from DefiLlama's open-source TVL adapter (585 protocols indexed). The list can include third-party tokens a protocol holds, such as USDC, so check the name column.

What we found

New: who can upgrade the 34 largest stablecoins · who controls every Morpho vault over $2M

Contracts that hold TVL: we read the control path of about 2,000 contracts from about 480 protocols, using addresses from DefiLlama's open-source TVL adapters. Each hit was then checked by hand, and we dropped third-party tokens and factories that can't touch existing funds. At least 35 protocols and token issuers have a core or fund-holding contract whose upgrade path ends at one EOA, with no on-chain multisig and no timelock.

Recently launched DeFi: 10 of the 125 protocols listed in the last 12 months, including a ~$157M stablecoin wrapper, a ~$142M BTC yield vault and a perps bridge that holds user deposits.
BTC and stablecoin yield: several vault and receipt tokens backing $100M-$300M protocols.
Tokenised assets: the largest issuers do it too. USDC, PYUSD, USDtb, BUIDL-I and several tokenised fund shares are upgradeable by a single EOA. These issuers almost certainly keep that key in an HSM, which is the point: the safety lives off-chain, where nobody else can see it, and there is no timelock that would give holders warning.

We contact each team privately before we publish contract-level rows. This applies whether or not they buy anything.

Governance and protocol tokens (480 scanned)

We took every DeFi protocol on DefiLlama with at least $300k TVL that lists an EVM governance or protocol token on one of 15 chains, then read each token's control path on-chain. Scanned 2026-10-06. These are public on-chain facts, and each address links to a block explorer so you can check it. "Single key" here means one EOA, which may be MPC- or HSM-backed off-chain. A single-EOA owner is not automatically dangerous: what matters is what that owner can call. For example, the Superform UP token has an EOA owner, but its mint is locked for 3 years and capped at 2% a year. Upgrade rights and mint rights are the serious cases.

Show single-key cases only ·

API for agents and integrators: $0.01 per call

The same control-path read as the free checker, as JSON, paid per call over x402 in USDC on Base or Arbitrum. No API key, no signup. Every admin (proxy admin, beacon owner, owner(), DEFAULT_ADMIN_ROLE members) is resolved through ProxyAdmin, Safe threshold and signer list, timelock delay or Avocado wallet, with a one-line verdict. 13 EVM chains.

GET https://onekeyaway.appin60.com/api/control?chain=8453&address=0x… · $0.01 via x402
GET https://onekeyaway.appin60.com/api/preview?chain=8453&address=0x… · free verdict only
OpenAPI · /api · Bad input is rejected before payment, so you never pay for an error.

MCP server (free, 100 calls/day): add https://onekeyaway.appin60.com/mcp as a remote MCP server, for example claude mcp add --transport http onekeyaway https://onekeyaway.appin60.com/mcp. Tools: control_map and watch_contract. Listed in the official MCP Registry as com.appin60.onekeyaway/control.

Try it with any x402 client, for example npx agentcash fetch "https://onekeyaway.appin60.com/api/control?chain=8453&address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913".

Permission Map for your protocol

Permission Map

$49

One-off. Card (Whop) or USDC/USDT

Every contract in your protocol (up to 25) mapped: proxy admin, owner, AccessControl roles, plus the privileged functions in the verified source (upgrade, pause, mint, oracle, withdraw)
Each role traced to the keys that sign it: EOA, Safe m-of-n with signer types, timelock delay
A ranked list of single points of failure, with explorer links for each claim
Delivered by email as Markdown and JSON within 12 hours of payment

See a sample: USDC on 3 chains →

Orders for this round are taken until 2026-10-14 06:00 UTC. If we can't deliver, you get a full refund to the paying address.

Admin-change alerts

Free for 3 contracts

Alerts Pro: $19/month for up to 50, by card on Whop; it activates for the email on your Whop account. A hosted stand-in for OpenZeppelin Defender Monitor's admin alerts, which shut down on 2026-07-01.

An email when a contract you depend on is upgraded, changes proxy admin, owner or DEFAULT_ADMIN_ROLE holder, or when a Safe threshold or signer set behind those changes
Watch your own Safe too: signers, threshold, modules, guard, fallback handler and singleton (the Bybit attack swapped the singleton)
Morpho vaults: also a change of the vault timelock
Checked about every 15 minutes. Double opt-in, one-click stop

FAQ

Is this an audit? No. We don't review your code logic. We map who holds the power to change it, which is the cause of most 2026 losses.

Why publish this table? Everything in it is readable on-chain by anyone, attackers included. Publishing it lets users and teams see it too. If your protocol is listed and you have fixed it, email us and we'll re-scan within 24h. If you think a row is wrong, tell us and we'll correct it.

How does the free checker work? It runs in your browser: it reads EIP-1967 slots, owner(), Safe getThreshold()/getOwners() and timelock delays over public RPC nodes. View the page source to see every call.