DeFi Admin Keys: Multisig Thresholds and Timelocks
Proxy admins, owners and multisig thresholds for each major protocol, with the timelock that stands between a change and its execution.
Multi-chainEthereumArbitrum+2Table · StrataPlanned
Rollup Decentralization: Upgrade Keys and Exit Windows
Who can upgrade each rollup's bridge contracts, and how much notice do users get before an upgrade?
For each rollup: who can upgrade its bridge contracts, how many signers must agree, how long upgrades wait and whether users can exit first.
ShareEmail it
Blueprint
What the table will hold.
The table as it will open in Strata. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
One row One row per rollup, read at a pinned Ethereum blockSorted by Exit window, lowest first
| Rollup | Proof system | Upgrade controlled by | Holder address | Signers required | Security council | Upgrade delaydays | Withdrawal timedays | Exit windowdays | Forced inclusion | Last upgrade | Receipt |
|---|---|---|---|---|---|---|---|---|---|---|---|
- Rollup rollup Chain
- The rollup whose Ethereum contracts the row reads.
- Proof system proof_system Text
- The proof system (fault proofs, validity proofs or none) and whether anyone can submit or challenge proofs.
- Upgrade controlled by upgrade_holder Text
- The account that finally controls the bridge proxies: a multisig, a timelock, a governance contract or a combination.
- Holder address holder_address Address
- The address of that controlling account, linked to its contract.
- Signers required threshold Text
- For a multisig holder, the signatures required out of its signers, from getThreshold() and getOwners().
- Security council council Text
- The security council's threshold and signer count and the powers it holds, where the rollup has one.
- Upgrade delay upgrade_delay Number
- The shortest delay before a non-emergency upgrade takes effect, from the timelock or governance contract.
- Withdrawal time withdrawal_time Number
- The median time for a native withdrawal to become final, from the withdrawal times dashboard.
- Exit window exit_window Number
- Upgrade delay minus withdrawal time; negative when an upgrade can land before users could leave.
- Forced inclusion forced_inclusion Text
- Whether users can force a transaction through Ethereum and the delay before the rollup must include it.
- Last upgrade last_upgrade Date
- The date of the most recent implementation change on the rollup's bridge contracts.
- Receipt receipt Link
- The pinned block and the reads behind the row.
Filter by Proof system, Upgrade controlled by.
About
What it answers, and for whom.
A rollup's bridge contracts on Ethereum hold the assets of everyone who uses it, and most of them can still be upgraded. This table reads, for each covered rollup, who holds that power, from the proxy admin behind its bridge, portal and inbox contracts to the account that finally controls it: a multisig, a timelock or a governance contract. For a multisig, it shows how many signers must agree.
The second half of the table is about time. It sets the delay before a non-emergency upgrade takes effect against the time a user needs to withdraw. It also shows whether the proof system is live and open to anyone and whether users can force a transaction through Ethereum if the sequencer ignores them. These are the facts behind the stages the Ethereum community uses to describe rollup maturity.
Every value is read from the contracts at a pinned Ethereum block and links to that read. The table describes what the contracts allow; it does not grade any rollup as safe or unsafe.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- The admin of each bridge, portal and inbox proxy is read from its ProxyAdmin owner() or the EIP-1967 admin slot at a pinned block, and followed to the account that finally controls it.
- Multisig thresholds and signer counts come from getThreshold() and getOwners() on each Safe; timelock delays come from getMinDelay() or the contract's own delay setting.
- Proof status is read from the contracts: the respected game type and game implementations on OP Stack chains, whether validation is open to anyone on Arbitrum and the verifier contracts on zk rollups.
- The exit window is the upgrade delay minus the time a withdrawal takes, using the withdrawal times measured on this site; a negative window means an upgrade can take effect before a user could leave.
- Forced inclusion is checked from the contracts that accept transactions from Ethereum, with the delay after which the rollup must include them.
The data it needs
Read from chain state and history
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- governance_votesTo buildGovernance proposals and votesProposals, votes, voting power and turnout in on-chain governors, with off-chain votes recorded with their source.
- l2_activity_dailyTo buildLayer 2 activity and costsPer layer 2 per day: transactions, active addresses, fees users paid on the L2, and what the L2 paid Ethereum to settle and post data.
- ProxyAdmin owner() and EIP-1967 admin and implementation slots of each rollup's bridge, portal and inbox proxies on Ethereum
- Safe getThreshold() and getOwners() of upgrade and security council multisigs at a pinned block
- Timelock getMinDelay() or equivalent upgrade delay settings
- OP Stack respectedGameType() and DisputeGameFactory gameImpls(), Arbitrum validator settings and zk rollup verifier contracts
- Forced inclusion paths: OptimismPortal deposits, the Arbitrum delayed inbox and the zk rollups' priority queues
- Upgraded events on each proxy, for the date of the last implementation change
Questions
Questions people ask.
What does it mean that a rollup can be upgraded?
Its bridge contracts on Ethereum sit behind proxies whose code can be replaced. Whoever controls the proxy admin can change how deposits and withdrawals work, so the safety of funds rests on that party as well as on the proof system.
What is an exit window?
The time users have to withdraw after an upgrade is announced and before it takes effect. If an upgrade can take effect faster than a withdrawal can complete, users who disagree with it cannot leave first.
What is a security council?
A multisig, usually of independent signers, that can act quickly in an emergency, for example to pause a bridge or fix a bug. A council that can bypass delays only in emergencies, with a high signing threshold, gives users more assurance than a small team multisig.
What are rollup stages?
A shorthand the Ethereum community uses for rollup maturity. Stage 0 relies on its operators. Stage 1 has a working proof system with a security council as a backstop. Stage 2 limits the council to provable bugs and gives users time to exit before upgrades. The table shows the contract facts behind those labels.
Can a sequencer censor my transaction?
It can delay it, but most rollups let users send a transaction through Ethereum that the rollup must include after a set delay. The table shows whether that path exists for each rollup and how long the delay is.
- Proxy admin
- The account allowed to replace the code behind an upgradeable contract.
- Security council
- A multisig of independent signers that can act on a rollup's contracts in an emergency.
- Exit window
- The time between an upgrade becoming known and taking effect, less the time a withdrawal needs.
- Forced inclusion
- A transaction sent through a rollup's Ethereum contracts that the rollup must include after a set delay, even if its sequencer ignores it.
Related
More apps like this.
Smart Contract Upgrade Tracker: Proxy and Owner Changes
Implementation, admin, owner and multisig signer changes on major protocol contracts, and the upgrades already queued in timelocks.
Multi-chainEthereumL2 Withdrawal Times to Ethereum by Rollup
How long a native withdrawal from each rollup to Ethereum takes, from the layer 2 transaction to the moment it can be finalized.
EthereumBaseOP Mainnet+9Safe Multisig Checker: Owners, Threshold and Modules
Inspect a Safe before trusting it: its signers, how many must sign, the modules and guards that can act on it and its recent changes.
Multi-chainEthereumBase+3Ethereum Layer 2 List Ranked by Activity, Fees and Value
Every covered Ethereum layer 2 in one sortable table: transactions, active addresses, user fees, costs paid to Ethereum and value secured.
Multi-chainEthereumBase+7Ethereum TPS: Mainnet and Layer 2 Transactions per Second
Transactions and gas per second on Ethereum and each layer 2, in total and per chain, counted from blocks without system transactions.
Multi-chainEthereumBase+6Build Rollup Decentralization: Upgrade Keys and Exit Windows on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.