An admin-capability matrix is a table with one row for every privileged action a project's contracts allow, and columns recording what the action does, which address can execute it, what authorization is required, how long the delay is, and what is lost if the key is abused or compromised. It turns an unanswerable question, is this protocol decentralized, into a set of answerable ones. Building it is a reading exercise against deployed code, not a design exercise.
The row that matters is whichever one pairs a total-loss blast radius with a zero-second delay. It exists in most projects, it is usually the proxy admin, and the team is usually surprised to see it written down.
Scroll to see the full diagram
Where the rows come from
You get them by reading deployed code, not the documentation. In an OpenZeppelin access control pattern the roles are named on-chain and readable: DEFAULT_ADMIN_ROLE, MINTER_ROLE, UPGRADER_ROLE and PAUSER_ROLE are the ones worth monitoring, and the RoleGranted and Upgraded events show when a capability was actually handed over or exercised.1 Anything guarded by onlyOwner is a row. Anything reachable through a proxy admin is a row. Anything a governance contract can execute is a row.
The capability list itself is not mysterious. Practitioner writing on admin keys enumerates the same set repeatedly: modify parameters, upgrade contracts, pause operations, transfer treasury funds, and change the oracle configuration.2 The matrix formalises that list per project, with the addresses filled in.
The proxy admin row eats the others
If a contract sits behind an upgradeable proxy, whoever controls the proxy admin can replace the logic entirely, which makes every other row in the matrix provisional. A comparative analysis of proxy admin privileges across governance models lists the powers as unilateral upgrade, changing the admin itself, and destroying the proxy, and contrasts how those behave under a single key, a multisig and a timelock.3
This is why a matrix that stops at token functions is misleading. A project can have an exemplary mint policy, a capped supply and a locked treasury, and a proxy admin that can rewrite all three in one transaction. Order the matrix so the upgrade rows sit at the top, because they are the ones that condition everything below.
Delay is the column doing the work
Signer counts get the attention and delays do the work. A multisig converts single-key compromise into signer collusion, which helps only if the signers can fail independently. A delay does something different: it gives anyone who disagrees with a pending action time to act on that disagreement before it executes. That is the only column in the matrix that hands a holder an option.
The delay has to be measured against how long an exit actually takes at real depth, not against a number that sounds reassuring. A 24 hour timelock on a token whose order book absorbs a fraction of a large holder's position in a day is a delay in name. Our view is that a delay is credible when a holder of meaningful size could leave inside it without moving the price, and the honest way to set it is to check the depth rather than the norm.
Publishing it is most of the value
The most useful version of this artifact in the wild is a public one. The DeFi Watch project maintained by Chris Blec tracks what admin keys can do across real protocols, alongside how they are held, and it exists because that information was otherwise scattered across contracts nobody outside the team had read.4 A project that publishes its own matrix removes the need for anyone to reconstruct it adversarially.
Across the 100+ projects we have advised, a complete matrix typically runs past a dozen distinct privileged functions, and two or three are news to somebody in the room. That surprise is the finding. The goal is not zero privilege, since a team should be able to stop a broken market. The goal is that every privileged action is delayed, distributed or governed, and that a reader can verify which without trusting anyone's summary.
Common questions
What goes in an admin-capability matrix?
One row per privileged action, and five columns: what the action does, which address executes it, what authorization is required, the execution delay, and the blast radius if the key is abused or compromised. Rows come from reading deployed contracts rather than documentation, covering every onlyOwner function, every named access-control role, every proxy admin power, and everything a governance contract can execute.
How do I find a protocol's admin functions?
Read the verified source on a block explorer and look for named roles and ownership modifiers. In an OpenZeppelin access-control pattern, DEFAULT_ADMIN_ROLE, MINTER_ROLE, UPGRADER_ROLE and PAUSER_ROLE are the roles to watch, and the RoleGranted and Upgraded events record when a capability was granted or exercised.1 Also check whether the contract sits behind an upgradeable proxy and who controls that proxy's admin.
Is a timelock enough to make admin keys safe?
It helps on the actions where waiting is acceptable and it is the wrong control where it is not. A delay gives holders time to react before an upgrade or a treasury move executes, which is the point. Applied to an emergency pause, the same delay removes the function's purpose. Set delays per capability rather than protocol-wide, and check the delay against how long an exit actually takes at real market depth.
See Tokenomics Audit Services for how this applies in practice.
Sources
- How to Spot a DeFi Protocol Admin Key Compromise
Phemex Academy, 2026
Names the OpenZeppelin AccessControl roles worth monitoring (DEFAULT_ADMIN_ROLE, MINTER_ROLE, UPGRADER_ROLE, PAUSER_ROLE) and the RoleGranted and Upgraded events that reveal when a capability is granted or exercised. Read 3 August 2026. - What Is an Admin Key? Protocol Centralization Risks
Fensory, 2026
Enumerates the recurring admin-key capability set: modify parameters, upgrade contracts, pause operations, transfer treasury funds, change oracle configuration. Read 3 August 2026. - Why Proxy Admins Are the Most Powerful and Dangerous Roles in Crypto
Chainscore Labs, 2026
Comparative table of proxy admin privileges (unilateral upgrade, change admin, destroy proxy) across single-key, multisig and timelock governance models. Read 3 August 2026. - What Is Admin Key Risk? (DeFi Watch)
Chris Blec, defiwatch repository on GitHub, 2026
Maintained public tracking of what admin keys can do across real DeFi protocols and how they are held. The closest thing to a published capability matrix in the wild. Read 3 August 2026.
Last reviewed 2026-08
Know the terms but not sure how they apply to your project? That is what an engagement is for. We design, document, and stress-test the whole token economy inside the Tokenomics Data Room.
100+ projects advised. Complete tokenomics in 4 to 6 weeks.