Base Chain
Stage 1On Base Chain, the Base Governance Multisig, a 2-of-2 multisig made up of the Base Coordinator Multisig and the Base Security Council, can instantly replace the code of 13 core contracts.
A portrait gallery of rollup governance
Who holds the keys?
Ethereum's rollups promise to inherit its security. Yet almost every one of them can be rewritten by a small group of people, often with no warning at all.
82rollups and validiums, painted
1,128keys on the walls, one per upgradable contract
71chains where the most powerful group can swap core contracts instantly
4chains where no one is named as a key-holder
Also in the gallery
Public companies
The same question asked of Meta, Alphabet, Tesla and Apple, read from their proxy statements.
How to read a painting
Seated in the gallery are the groups who can upgrade the chain's contracts, that is, replace their code with anything they like. Hanging below each group are its keys, one for every contract it can replace.
Who is in the room
Black robes and ruffsA security council: a multisig of named, mostly independent signers.
Coloured coatsA team or company multisig. Each colour is a different group.
The lone clerkA single private key. One person, one signature.
The crowd at the urnA token vote. Slow, public, and usually behind a long timelock.
Grey visitorsAnother system's operators, holding keys to infrastructure the chain relies on.
What their keys open
Gold key: a core contractThe bridge, the portal, the proof system, the messengers. A malicious upgrade here can reach users' funds.
Iron key: a peripheral contractFee vaults, the gas oracle, the NFT bridge, the pause switch. They matter, but they can't move your funds.
A ring of small keys: someone else's systemContracts the chain depends on but doesn't run, such as EigenLayer. Drawn once, however many there are.
Speed matters
⏳ marks a key behind a timelock. A long enough delay lets users see an upgrade coming and leave before it lands; a key with no delay can change the rules overnight.
The gallery
82 chains
Arbitrum One
Stage 1On Arbitrum One, the Arbitrum Security Council, a 9-of-12 multisig, can instantly replace the code of 28 core contracts. A token vote can do the same, after a 17d 8h delay.
Polygon PoS
No stageOn Polygon PoS, the PolygonMultisig, a 5-of-9 multisig whose signers include the Katana Foundation Engineering/Security Multisig and the Polygon Labs Engineering/Security Multisig, can instantly replace the code of 9 core contracts.
Robinhood Chain
Stage 0On Robinhood Chain, the Robinhood Multisig 1, a 7-of-8 multisig whose signers include the Robinhood Multisig 3, can instantly replace the code of 14 core contracts.
OP Mainnet
Stage 1On OP Mainnet, the SuperchainProxyAdminOwner, a 2-of-2 multisig made up of the OpFoundationUpgradeSafe and the Optimism Security Council, can instantly replace the code of 11 core contracts.
Mantle
Stage 0On Mantle, the MantleSecurityMultisig, a 6-of-14 multisig, can instantly replace the code of 8 core contracts.
Lighter
Stage 0On Lighter, the Lighter Multisig 2, a 3-of-5 multisig, can replace the code of 3 core contracts after a 21d delay.
World Chain
Stage 0On World Chain, the Alchemy Multisig 1, a 3-of-8 multisig, can instantly replace the code of 6 core contracts.
Ink
Stage 1On Ink, the SuperchainProxyAdminOwner, a 2-of-2 multisig made up of the OpFoundationUpgradeSafe and the Optimism Security Council, can instantly replace the code of 11 core contracts.
Starknet
Stage 1On Starknet, the Starkware Multisig 2, a 2-of-4 multisig, can instantly replace the code of 7 core contracts.
Linea
Stage 0On Linea, the Linea Security Council, a 5-of-9 multisig whose signers include the Safe, can instantly replace the code of 7 core contracts.
Gnosis Chain
No stageOn Gnosis Chain, the Gnosis Bridge Multisig (Ethereum), a 8-of-15 multisig whose signers include the Hashi Multisig (Ethereum), can instantly replace the code of 7 core contracts.
Celo
Stage 0On Celo, the CeloProxyAdminOwner, a 2-of-2 multisig made up of the Celo Security Council and the Celo cLabs Multisig, can instantly replace the code of 12 core contracts.
ZKsync Era
Stage 0On ZKsync Era, the EmergencyUpgradeBoard contract can instantly replace the code of 9 core contracts.
Ronin
Stage 0On Ronin, the RoninConduitOwner, a 5-of-6 multisig, can instantly replace the code of 7 core contracts.
X Layer
No stageOn X Layer, the Xlayer Multisig, a 2-of-3 multisig, can instantly replace the code of 5 core contracts.
Morph
Stage 0On Morph, the Morph Multisig 1, a 4-of-6 multisig, can instantly replace the code of 12 core contracts.
Fraxtal
Stage 0On Fraxtal, the Fraxtal Multisig 1, a 3-of-5 multisig, can instantly replace the code of 4 core contracts.
Manta Pacific
Stage 0On Manta Pacific, the MantaMultisig, a 5-of-7 multisig, can instantly replace the code of 4 core contracts.
Unichain
Stage 1On Unichain, the SuperchainProxyAdminOwner, a 2-of-2 multisig made up of the OpFoundationUpgradeSafe and the Optimism Security Council, can instantly replace the code of 11 core contracts.
MegaETH
Stage 0On MegaETH, the Safe, a 6-of-10 multisig whose signers include the Safe, can instantly replace the code of 7 core contracts.
BOB
Stage 0On BOB, the Bob Multisig 1, a 4-of-6 multisig, can instantly replace the code of 7 core contracts.
Plume Network
Stage 0On Plume Network, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 10 core contracts.
Katana
Stage 0On Katana, the SafeL2, a 3-of-5 multisig, can instantly replace the code of 3 core contracts.
Blast
Stage 0On Blast, the BlastMultisig 1, a 3-of-5 multisig, can instantly replace the code of 7 core contracts.
Scroll
Stage 0On Scroll, upgrades to 23 core contracts run through ScrollOwner, a role-based owner contract.
Metis Andromeda
Stage 0On Metis Andromeda, the Metis Security Council, a 6-of-8 multisig, can instantly replace the code of 9 core contracts.
Paradex
No stageOn Paradex, the Paradex Multisig 2, a 3-of-5 multisig, can instantly replace the code of 3 core contracts.
RISE
Stage 0On RISE, the Rise ProxyAdminOwner Multisig, a 3-of-5 multisig, can instantly replace the code of 6 core contracts.
Cronos zkEVM
Stage 0On Cronos zkEVM, the EmergencyUpgradeBoard contract can instantly replace the code of 8 core contracts.
Immutable zkEVM
No stageOn Immutable zkEVM, the ProxyAdmin contract can instantly replace the code of 2 core contracts.
SX Network
Stage 0On SX Network, the CalderaMultisig, a 3-of-5 multisig, can instantly replace the code of 10 core contracts.
Soneium
Stage 0On Soneium, the SuperchainProxyAdminOwner, a 2-of-2 multisig made up of the OpFoundationUpgradeSafe and the Optimism Security Council, can instantly replace the code of 7 core contracts.
Abstract
Stage 0On Abstract, the EmergencyUpgradeBoard contract can instantly replace the code of 8 core contracts.
Fuel Ignition
No stageOn Fuel Ignition, the Fuel Security Council, a 4-of-6 multisig, can instantly replace the code of 3 core contracts.
Aevo
Stage 0On Aevo, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
Lumia Prism
No stageOn Lumia Prism, the PolygonAdminMultisig, a 5-of-9 multisig, can replace the code of 3 core contracts after a 3d delay.
Taiko Alethia
Stage 0On Taiko Alethia, the SignerList (Security Council), a 4-of-5 multisig, can replace the code of 16 core contracts after a 7d delay.
ADI Chain
Stage 0On ADI Chain, the Governance contract can instantly replace the code of 7 core contracts.
Zircuit
Stage 0On Zircuit, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 7 core contracts.
Haust Network
No stageOn Haust Network, the PolygonAdminMultisig, a 5-of-9 multisig, can replace the code of 3 core contracts after a 3d delay.
Orderly Network
Stage 0On Orderly Network, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
Arbitrum Nova
Stage 0On Arbitrum Nova, the SecurityCouncil, a 9-of-12 multisig, can instantly replace the code of 16 core contracts. The L1Timelock can do the same, after a 3d delay.
Gravity
Stage 0On Gravity, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 8 core contracts.
Silicon
No stageOn Silicon, the PolygonAdminMultisig, a 5-of-9 multisig, can replace the code of 3 core contracts after a 3d delay.
Polygon zkEVM
No stageOn Polygon zkEVM, the Polygon zkEVM Multisig, a 5-of-10 multisig, can instantly replace the code of 3 core contracts.
HashKey Chain
Stage 0On HashKey Chain, the NXV, a 3-of-5 multisig, can instantly replace the code of 7 core contracts.
Mode Network
Stage 0On Mode Network, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
Boba Network
Stage 0On Boba Network, the Boba Multisig, a 2-of-3 multisig, can instantly replace the code of 6 core contracts.
Eclipse
No stageOn Eclipse, the Eclipse Multisig 2, a 3-of-5 multisig whose signers include the GnosisSafe, can instantly replace the code of 1 core contract.
Lisk
Stage 0On Lisk, the Gelato Multisig, a 3-of-4 multisig, can instantly replace the code of 6 core contracts.
Sophon
Stage 0On Sophon, the EmergencyUpgradeBoard contract can instantly replace the code of 9 core contracts.
Zora
Stage 0On Zora, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
Reya
Stage 0On Reya, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 8 core contracts.
Cyber
Stage 0On Cyber, the Cyber Multisig 1, a 3-of-4 multisig, can instantly replace the code of 7 core contracts.
Pentagon Chain
No stageOn Pentagon Chain, the PolygonAdminMultisig, a 5-of-9 multisig, can replace the code of 3 core contracts after a 3d delay.
Fluent
No stageOn Fluent, the FluentMultisig, a 4-of-5 multisig, can instantly replace the code of 5 core contracts.
Shape
Stage 0On Shape, the Alchemy Multisig 1, a 3-of-8 multisig, can instantly replace the code of 6 core contracts.
Hemi
Stage 0On Hemi, the GnosisSafe, a 3-of-8 multisig, can instantly replace the code of 4 core contracts.
Lens
Stage 0On Lens, the EmergencyUpgradeBoard contract can instantly replace the code of 9 core contracts.
DeBank Chain
Stage 0On DeBank Chain, the DeBank Multisig, a 2-of-4 multisig, can instantly replace the code of 4 core contracts.
Lasernet
Stage 0On Lasernet, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 8 core contracts.
Shibarium
No stageOn Shibarium, a single private key (EOA 1) can instantly replace the code of 7 core contracts.
Facet
Stage 2L2BEAT's data names no one who can upgrade Facet. The key rack is empty.
Nillion
Stage 0On Nillion, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
LightLink
No stageOn LightLink, the Lightlink Multisig 2, a 3-of-3 multisig, can instantly replace the code of 6 core contracts.
Phala
Stage 0On Phala, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
Soon Alpha Mainnet
Stage 0On Soon Alpha Mainnet, the SoonMultisig, a 2-of-4 multisig, can instantly replace the code of 4 core contracts.
Metal
Stage 0On Metal, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 6 core contracts.
AlienX
Stage 0On AlienX, the AlienXMultisig, a 3-of-5 multisig, can instantly replace the code of 10 core contracts.
Pepe Unchained
Stage 0On Pepe Unchained, the Conduit Multisig 1, a 4-of-11 multisig, can instantly replace the code of 8 core contracts.
Swan Chain
Stage 0On Swan Chain, the Swan Network Multisig, a 3-of-4 multisig, can instantly replace the code of 4 core contracts.
ZKFair
No stageOn ZKFair, the ZKFairAdmin, a 3-of-4 multisig, can replace the code of 4 core contracts after a 1d delay.
Funki
Stage 0On Funki, the Funki Multisig 1, a 3-of-4 multisig, can instantly replace the code of 7 core contracts.
Aztec Network
Stage 2L2BEAT's data names no one who can upgrade Aztec Network. The key rack is empty.
Appchain
Stage 0On Appchain, the Caldera Multisig 3, a 3-of-6 multisig, can instantly replace the code of 8 core contracts.
Towns
Stage 0On Towns, the RiverMultisig, a 4-of-7 multisig, can instantly replace the code of 4 core contracts.
Cartesi PRT Honeypot v2
Stage 2L2BEAT's data names no one who can upgrade Cartesi PRT Honeypot v2. The key rack is empty.
Settlus
Stage 0On Settlus, the Alchemy Multisig 1, a 3-of-8 multisig, can instantly replace the code of 6 core contracts.
Payy
No stageOn Payy, the PayyMultisig, a 2-of-4 multisig, can instantly replace the code of 1 core contract.
Ethscriptions
Stage 2Nobody can upgrade Ethscriptions. Its upgradable contracts answer to an admin contract that has no owner, so no one can ever call it. The key rack is empty.
GRVT
Stage 0On GRVT, the EmergencyUpgradeBoard contract can instantly replace the code of 6 core contracts.
Why it matters
Code is only as trustless as the people who can change it.
A rollup's contracts hold the money that crossed its bridge. Whoever can upgrade those contracts can, in principle, redirect it. Most teams keep that power on purpose: young systems have bugs, and someone has to be able to fix them fast.
The question is who that someone is. Is it a council of independent signers, a company's own multisig, or one key on one laptop? Does the change land instantly, or after a delay long enough for users to leave? These paintings answer that at a glance, for every chain.
Snapshot of 23 October 2026.