cryptolicit

Upgradeable contract (proxy)

The contract is a proxy: the logic behind it can be replaced later.

Why it matters

What you audited today is not necessarily what runs tomorrow. Common in serious projects, but it is still power somebody holds.

Severity in our model
Warning
Applies to
Ethereum and other EVM chains
Where we read it
Contract analysis (GoPlus Security)
Tokens we found it on
28 tokens of 5,361 checked

Tokens where we found this

From the tokens we have checked, most traded first. A finding on this list is a property of the contract or the pool — read the token's page for the full picture before drawing a conclusion.

Who holds this power, and when it matters

This is a capability, not an event: nothing has happened to the token because of it. What it means is that a specific address can decide something about your holding later. On a regulated issuer — a stablecoin, a bank-issued token — that power is usually disclosed policy, used to comply with court orders, and the issuer has a name and an address. On an anonymous token it is the piece that turns a normal-looking launch into a trap once enough money is in. The question worth asking is not "does the power exist" but "who holds it, and what do they lose by using it".

What to check next

Look at whether ownership has been renounced, and whether it can be taken back. A renounced contract with no hidden owner cannot use owner-only powers at all — we mark that on the token page when it applies. Then look at how the supply is distributed: a power in the hands of someone who also holds most of the tokens is a much shorter path to a loss than the same power held by an issuer with a business to protect.

How to check it yourself

Everything we report can be verified without us. Open the contract on the block explorer for its chain, read the verified source if there is one, and look at the holders tab: who holds the supply, whether the pool tokens sit in a lock contract or a personal wallet. For market data, compare the pool size with how much actually trades — a pool nobody trades in is a number, not an exit.

If you are about to buy, the cheapest test is the smallest one: buy a tiny amount, then immediately try to sell it. A contract that blocks selling will tell you so for a few dollars instead of everything you were about to put in.

Related checks

Questions

What does "Upgradeable contract (proxy)" mean on a token?

The contract is a proxy: the logic behind it can be replaced later. What you audited today is not necessarily what runs tomorrow. Common in serious projects, but it is still power somebody holds.

Does it mean the token is a scam?

No. It is a property of the contract or a fact about the market, read from a public source at a point in time. On its own it does not stop you selling. It is context, and it matters most alongside the other findings on the token page.

Where do you read it from?

From contract analysis (GoPlus Security), which reads the deployed contract and its authorities directly on chain.

All checks · how the verdict is calculated · tokens we have checked