Governance Audit

Know exactly who can change your protocol.

A control-plane review that maps every upgrade path, governance actor, and timelock bypass route across your contracts. We reconstruct the real authority model from on-chain state, not the org chart, so you know who can change what, and how fast.

Request a Governance AuditRun a free scan first

In-depth · Control-plane analysis

The problem

Most DeFi risk is governance, not code.

A perfectly audited contract is still unsafe if one key can upgrade it with no delay. The authority around the code (who can change it and how fast) is where the largest, least-visible risk lives.

Multisig overrides and undocumented admin paths that bypass the intended process.
Proxy upgrade chains that are hard to reason about and easy to get wrong.
Timelocks that can be bypassed, cancelled, or shortened through an overlooked role.
Emergency powers and guardian roles with far more reach than users assume.
Authority that shifts over time with little public visibility.

Scope

What we review

We reconstruct the full authority graph from on-chain state and stress every path that can change the protocol.

Upgrade paths
Every proxy and admin path that can change contract logic, mapped end to end.
Governance actors
Resolution of every actor (Safe, Timelock, Governor, EOA) and what each can do.
Timelock configuration
The real, effective delay users actually get before a change can take effect.
Bypass paths
Routes that skip the timelock or governance process, ranked by reachability.
Admin & guardian roles
Privileged roles, emergency powers, and the blast radius of each.
Authority over time
How control has shifted across upgrades and role changes.

Methodology

How the analysis works

We combine automated authority-graph reconstruction with manual review of the paths that matter most.

01
Scoping
Identify the contracts, proxies, and governance components in scope.
02
Authority mapping
Reconstruct the full upgrade-and-admin authority graph from on-chain state.
03
Actor resolution
Classify every actor (multisig, timelock, governor, or EOA) and its powers.
04
Bypass analysis
Enumerate and rank paths that can skip the timelock or governance process.
05
Report
Deliver the authority graph, effective delays, bypass paths, and on-chain evidence.

Deliverables

Deliverables

Authority graph
A complete map of every upgrade and admin path, with each actor and its powers.
Effective-delay analysis
The real delay users get before a change lands, not the configured value, the effective one.
Ranked bypass paths
Every route that can skip governance, ordered by reachability and impact.
On-chain evidence
For each finding, the on-chain state that proves it, reproducible and verifiable.

A free control-plane scan gives you a baseline in seconds. A full Governance Audit adds manual review, bypass enumeration, and evidence.

Why Themis

Why Themis

Control-plane specialists
Governance, upgradeability, authority paths, and timelock bypass risk are our core focus.
On-chain truth
We reconstruct the real authority model from on-chain state, not from documentation or intent.
Backed by tooling
Our analysis platform reconstructs authority graphs across major EVM chains, you can scan any protocol yourself.
One philosophy, two domains
The same question we ask of an AI agent: who controls this, and can that control be abused?

FAQ

Questions we get asked

How is this different from a smart-contract audit?

A code audit reviews contract logic. A Governance Audit reviews the authority around it, who can change the code, through which paths, and how fast. They complement each other.

Which chains do you support?

Ethereum, Arbitrum, Optimism, Base, and Polygon, with more on request. The free scan covers the same set.

Can I try it before committing?

Yes, run a free control-plane scan on any proxy contract. The Governance Audit adds manual bypass analysis, evidence, and a written report.

What does the deliverable look like?

An authority graph, the effective timelock delay, a ranked list of bypass paths, and on-chain evidence for each finding.

Who can change your protocol?

Run a free scan for a baseline, or request a full Governance Audit with manual bypass analysis and evidence.

Request a Governance AuditExplore Web3 Security