Protocol Report · Ethereum
DemoThis is a sample report generated from public on-chain data, not a live audit. Run a fresh scan on any address to see current governance state.

zkSync Era Diamond Proxy

Some Risk
Why this score
  • Implementation can be replaced (upgradeable proxy)
  • Short delay (no upgrades possible): less than typical safe standards
  • No governance bypass paths detected
Control-Plane Score
60/100
Higher = cleaner
Control plane only · code-layer risk is out of scope

Moderate Upgrade Risk

Medium Risk

Upgrades go through no upgrade authority detected with a no upgrades possible reaction window.

What this means

The setup has reasonable protection, but the delay is short or the controller setup has limited safeguards. Consider improvements before treating this as fully safe.

Reaction window

no upgrades possible.

Proxy Pattern
Upgradeable Proxy
The implementation logic can be replaced
Who Can Upgrade
No upgrade authority detected
Contract address that holds upgrade authority
Reaction Window
No upgrades possible
Contract is immutable
Governance Bypass Paths
None detected
All upgrade paths appear to use the standard process

Key Findings

The main control-plane risks found in this scan, with plain-English impact and remediation.

Structural Risk

Upgradeable proxy detected

Meaning: The protocol logic can be replaced after deployment. This is common, but it makes the safety of the upgrade process critical.

Fix: Document the upgrade process publicly and monitor implementation changes in real time.

Possible Failure Scenario

A concrete sequence of how this risk could play out. This is illustrative, not a prediction.

This is not a detected exploit. It illustrates the control failure this configuration may allow.

  1. 1A controller proposes an upgrade through one of the available paths.
  2. 2After no upgrades possible, the upgrade activates.
  3. 3The new implementation changes some aspect of protocol behavior.
  4. 4If users were not monitoring on-chain proposals, they may not have had time to react.
  5. 5The change becomes the new normal until the next upgrade.

Recommended Fixes

5 of 7 recommended fixes still apply to this protocol.

Immediate fixes

Architectural changes that close the most direct risk paths.

  1. 1Remove direct wallet upgrade permissions.Already in place
  2. 2Move upgrade authority to a multisig with a meaningful threshold, such as 3-of-5 or higher.
  3. 3Add a timelock, such as 24–72 hours, to every upgrade path.
  4. 4Verify that no alternate upgrade path bypasses governance or the timelock.Already in place

Operational fixes

Process and monitoring practices that reduce ongoing risk.

  1. 1Monitor implementation changes in real time and alert users on any upgrade.
  2. 2Maintain a public changelog for every upgrade.
  3. 3Document the intended governance and emergency upgrade process.

Evidence

The on-chain data behind the findings above. Switch to Advanced to see raw addresses, blocks, and method-level detail.

Control Map

Who can change the protocol and through which path.

How to read this map
owns = controls another contract or permission
upgrades = can change the implementation
acl of = has an access-control relationship
UUPS PROXYUUPS PROXYcontract

Upgrade Activity

Recorded implementation or admin changes detected on-chain.

No upgrades have been recorded for zkSync Era Diamond Proxy since it was deployed.

Want a control-plane scan for your protocol?

See exactly who controls upgrades, how long users have to react, and whether any path can bypass governance, for any protocol you operate or depend on.

Includes authority graph, bypass paths, effective delay, and upgrade history.

Scan My ProtocolTalk to Themis →