How to check if a token uses a proxy contract and can be upgraded
A proxy contract is a shell. It holds the token's balance, but the actual code that runs when you trade or transfer lives in a separate contract. That separate contract - the "implementation" or "logic" contract - can be swapped out by someone with admin keys.
If a token uses a proxy, the address you see on a block explorer is not where the code lives. It is a forwarding address. The real rules of the token, such as fees, transfer restrictions, or mint functions, can change without the token address changing. This is the core risk.
How to spot a proxy on Etherscan
On Ethereum or EVM-compatible chains, the easiest check is to open the token contract on a block explorer. If you see a tab labeled "Read as Proxy" or "Read as Implementation", the contract uses the proxy pattern.
Below that, a field called "Implementation" shows the address of the logic contract. Click it. That contract contains the actual Solidity code. If the implementation contract has an initialize function or uses the UUPSUpgradeable pattern, changes are possible.
Some tokens disguise proxies by naming the logic contract "TokenV1" or "Implementation" or by hiding it behind a non-standard admin system. Read the source code of the implementation to see if upgradeTo or upgradeToAndCall exists. If it does, the proxy is active.
Finding the admin address
EIP-1967 defines standard storage slots for proxy contracts. Two slots matter:
- The implementation slot:
0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc - The admin slot:
0xb53127684a568b3173ae13b9f8a6016e243e63b6fc8a39f5e54a3c5c14b8b48b
You do not need to write raw queries. Use a block explorer's "Storage" or "Slot" reader. Paste the admin slot hash. The 20-byte address stored there is the admin - the account that can call upgradeTo.
If the admin slot contains the zero address (0x0000...0000), the admin has been renounced. Upgrades are no longer possible. If it contains any other address, that address holds the power to swap the implementation.
Transparent proxies vs. UUPS
The two common proxy flavors handle upgrades differently.
Transparent proxy: The admin and users share the same proxy contract. The admin can only call upgrade functions; users cannot accidentally trigger them. The proxy uses a fallback function to delegate calls. This is older but still widespread.
UUPS (Universal Upgradeable Proxy Standard): The upgrade logic lives inside the implementation contract itself. The proxy is minimal - just the forwarder. If an upgrade removes the upgradeTo function, the contract becomes permanently non-upgradeable. That can be intentional or a trap.
Both patterns allow upgrades until the admin renounces or the upgrade function is removed. UUPS gives the illusion of safety because the proxy is tiny, but the risk is the same.
Why an unrenounced admin is a major rug vector
An admin that can call upgradeTo can replace the implementation with any contract. That means:
- A token that lets anyone mint unlimited supply.
- A token that blocks all transfers for everyone except the admin.
- A token that steals approval allowances or the entire contract balance.
No amount of locked liquidity protects you. The liquidity pool contract holds your tokens, but the proxy can change the transfer rules for the entire token - including what happens when the pool tries to sell.
Dozens of rug-pulls in 2021-2023 followed this exact pattern: a pleasant token with locked liquidity, a verified proxy, and a live admin that one day called upgradeTo and replaced the logic with a honeypot.
The only "safe" proxy state is one where the admin slot is zero, and the implementation contract does not contain any upgrade function. Even then, check that the implementation does not have a selfdestruct instruction or a backdoor that the proxy's fallback can trigger.
Practical steps for any token
- Open the contract on a block explorer.
- Look for "Read as Proxy" or "Implementation" fields.
- Read the admin address using Etherscan's Storage tool (the
0xb531...slot). - If the admin is not zero, do not trust the token. Move on.
- If the admin is zero, check the implementation contract for
upgradeTo. If it's absent, the token is frozen. That is the least risky proxy state.
No proxy is inherently malicious. Many well-known tokens use them to fix bugs gradually. But you must verify that the admin keys are dead. Otherwise the token is a time bomb.
Not financial advice. 1msc.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.