Free · no signup · read-only
What does this contract let someone change?
Paste an address. This reads the contract's upgrade and admin surface straight from the chain and tells you what an attacker could reach. Nothing is stored, nothing is signed, and no key is involved.
What you're looking at
Two things decide how much damage a compromised key can do.
Upgrade surface
If the contract is an EIP-1967 proxy, its logic can be replaced. The stored implementation address is what actually executes your calls — and whoever can change it controls everything the contract holds.
Who holds that power
If the admin is a contract, the authority is probably a multisig or timelock — slow and visible. If it is an externally-owned account, a single stolen key can swap the implementation with no delay.
Limits
This covers the standard EIP-1967 slots only. Proxies using other patterns (UUPS, beacon, Diamond) show as “not detected” here even though they may still be upgradeable. A clean result is not an all-clear. This is a read-only check, not an audit, and not security advice.
Want it watched continuously?
The free check is a snapshot. ProxyWatch runs it on a schedule and messages you the moment the surface changes, with the block and transaction behind it.