Single-key admins aren't rare.
They're concentrated.

Finding

The number isn't the story — the sampling is

A common pitch in on-chain security is "we catch the single-key admin" — upgrade authority sitting on one key, no multisig, no timelock. That pitch assumes the condition is common. So we measured it, twice.

• First pass (220 Ethereum candidates): 2 of 106 known-admin proxies were EOA-admined — 1.9%. That looked like a weak wedge.
• Second pass (600 candidates per chain, same classifier): 1,184 proxies, of which 33 (6.4%) of the 518 exposing an admin still use an EOA.
• The same classifier returns 1.9% / 26.7% / 8.7% on three different draws of the same data.
• It is concentrated: 22 of the 27 Ethereum EOA admins sit in one legacy pattern, AdminUpgradeabilityProxy.

The 1.9% was an artifact of how the first sample was drawn, not a property of the ecosystem. Both passes are reported here because the correction is the more useful result.

Method

Read-only, public data, no keys

1. Enumerate proxy candidates by exact contract-name match on the free Blockscout v2 API — TransparentUpgradeableProxy, ERC1967Proxy, AdminUpgradeabilityProxy — 600 de-duplicated candidates per chain.
2. Classify each over public JSON-RPC by reading the EIP-1967 implementation, admin and beacon storage slots.
3. Decide admin = EOA when the admin slot is non-zero and eth_getCode(admin) returns 0x; admin = contract when code is present; admin slot empty otherwise.

No keys, no transactions, no paid data; public RPC with failover. Ethereum enumeration is fully scriptable. Base is Cloudflare-gated for scripts, so its half was enumerated through a headless browser — a stated weakness.

Results

Per chain, per admin pattern

Measure	Ethereum	Base	Combined
Candidates scanned	600	600	1,200
Not a proxy (no slot)	11	5	16
Proxies	589	595	1,184
admin = contract	282	203	485
admin = EOA	27	6	33
admin slot empty	280 (47.5%)	386 (64.9%)	666
EOA admin (of known)	8.74%	2.87%	6.37%

Known-admin proxies: 309 (Ethereum) + 209 (Base) = 518. Zero beacon slots were observed, because the sampled names do not include BeaconProxy-style contracts.

Same classifier, three draws

Draw	EOA admin	Rate
v1 — search endpoint, 220 candidates	2 / 106	1.9%
Relevance-ordered search slice (151)	20 / 75	26.7%
Recency-ordered smart-contracts (600)	27 / 309	8.7%

Interpretation

What actually follows

• "Single-key admin" is not a ~2% curiosity. On a larger, recency-ordered draw it is ≈9% on Ethereum; on a relevance-ordered draw far higher. The v1 headline was the low end of its own sample.
• The risk is concentrated, which makes it addressable. Almost all EOA admins are one legacy pattern. A detector that tags that pattern is precise; one that treats every proxy uniformly dilutes the signal.
• The coverage gap persists across chains. ~48% of Ethereum and ~65% of Base proxies expose no EIP-1967 admin — the authority may be UUPS, beacon, a custom slot, or genuinely renounced.
• Chain matters. Base shows fewer EOA admins and more admin-empty proxies than Ethereum, consistent with newer, more ERC-1967-native deployments.

Limits

What this measurement does not show

Run it yourself — that is the point. Scripts and raw counts are in the repository; the finding above is reproducible from public data.