← All signals / ← Tous les signaux

Warning signal

Mutable Proxy (Active Admin)

The proxy's EIP-1967 admin slot is set - the implementation (the logic) can be swapped at any time.

Analyzer: Bytecode Patterns
Slug: mutable_proxy_admin

What it means

The EIP-1967 admin storage slot holds a non-zero address. That admin can point the proxy at a different implementation, replacing the token's entire logic in a single transaction. The proxy address never changes, so the swap is invisible on explorers.

Why it matters

An active admin is a live rug switch. The audited code you see today can become a drain-everyone implementation tomorrow, with no warning on the address you trusted. Without a time-lock the change is instant.

How RektRadar detects it

Reads the EIP-1967 admin storage slot of the resolved proxy. A non-zero admin raises the flag; an empty slot makes no immutability claim (UUPS keeps its upgrade authority in the implementation, not this slot).

Detected on 8 tokens in our dataset so far, 8 classified scam. Sample still small - a reliable scam rate needs more occurrences.

Snapshot from RektRadar's token_analysis database as of 2026-06-20.

Recent tokens with this signal

Loading recent tokens…

Analyze a token →

Related signals

Suspicious Function Selectors - The bytecode exposes function selectors known to enable rugs (sweepETH, removeLiquidityNoFee, etc.). Source Unverified - No verified source on Etherscan - analysis falls back to bytecode-only signals. Very Small Contract - The bytecode is too small to be a real ERC-20 - likely a proxy front for malicious logic. Known Scam-Factory Bytecode - The contract's bytecode is byte-identical to a confirmed mass-scam factory we have already flagged thousands of times. DELEGATECALL Opcode - The contract can execute external code in its own context - the basis of upgradeable/proxy logic.