
Most rugs don't need a bug, they need an upgrade key.
The proxy holds the funds. The logic lives in a separate implementation contract the proxy points to.
Whoever controls the admin key can swap that logic after launch, after your money is already in, so that the token you checked on day 1 is not the token running on day 30.
A pre-deploy scan asks three things:
- Is it a proxy? (EIP-1967, UUPS, transparent)
- Who holds the upgrade role: an EOA, a multisig, or a timelock?
- Can the logic be swapped with no delay and no notice?
Renounced ownership on the token means little if the proxy admin is a fresh EOA.
A scan is not an audit. But it tells you, in plain language, whether someone can rewrite the rules after you're in.
English



























