Thread by @Neodyme

Who **actually** controls the largest projects on #solana? What's the deal with Upgrade Authorities? Are your funds more safu in DeFi contracts than they were on #FTX?

Let's find out 🧵👇

For this thread, we analysed the Upgrade Authorities of the top 10 TVL projects on DefiLlama.

What are Upgrade Authorities (UAs)? 👮

UAs are the accounts in charge of changing a solana program's code.

Naturally, they pose a huge security risk. If you control the UA, you control the smart contract and its funds.

However, they are a necessary evil.
If you want to fix a bug in a program, or add new features, this is done through UAs.
For more info on UAs, check our blog post from June: blog.neodyme.io/posts/solana_u…

Specifically, the top 10 TVL projects we analysed are:
- @solendprotocol
- @MarinadeFinance
- @LidoFinance
- @RaydiumProtocol
- @ProjectSerum
- @TulipProtocol
- @orca_so
- @QuarryProtocol
- @Saber_HQ
- @Francium_Defi

Of the 10 projects analysed, we found the following about their upgrade authorities: (educated guesses)

- 3 have a hot wallet 💩
- 2 have a hardware wallet
- 5 have a multisig or DAO

Many are currently migrating to a mixed solution.

(This is pretty bad tbh)

How to verify this yourself? 🔬
(Note that this only gives you information on how upgrades were handled so far)

First, you need to find the program address of the dApp you are trying to investigate. There are many ways to do this: Often, it is listed in the docs or open source code.

If not, you can try and see if a block explorer like solscan already knows the address of that dApp by its name. Finally, you can also do a test transaction and view the program it interacts with on-chain.

Once you have the program address, you can use any explorer of your choice to find its upgrade authority -- it's listed directly on its explorer page. You can also see the address of the program data and the last slot it was changed.

Using the explorer, you can navigate to the program data address. The transactions you see are the program upgrades.

Lets check the UA. If there are many transactions within a few seconds landing in the same slot, the upgrade auth is almost certainly managed by a hot wallet. OTOH, if the upgrades are managed using a multisig or DAO, you can see this by program invocations in the upgrade txs.

If you see a hot wallet, or even a hardware wallet, being used as an upgrade authority for a major dApp, be careful when interacting with it. ⚠️ They potentially have the power to rug pull all of your funds.

We've been pushing for more transparency in upgrade authority handling for some time now.

If you see a large project using a hot wallet or hardware wallet, you can help us by asking them why they haven't migrated to a multisig. Stay safe out there.

If you are running a large project and are still using a hot, or even cold wallet instead of a multisig or DAO,

MIGRATE IT!

We gave a talk at #Breakpoint @SolanaConf about this topic last week. Follow us to get notified once it's online!