Contact: contact@realspap.com
Who can change a DeFi contract, how fast, and what we could not read. On-chain research and a public authority oracle (testnet). Replay commands included.
Findings, data and on-chain sources are public. Licence per repository: CC BY 4.0 for the data and text of the three showcases, MIT for code and for onchain-postmortems.
- multisig-overlap: who holds multisig signer keys across several independent DeFi protocols at once. Checked at three scales: 411 protocol entries and 749 confirmed multisig contracts across 25 chains (214 on Ethereum mainnet, 99 on Optimism's Superchain, 98 on Arbitrum and 10 more L2s and sidechains). The widest single signer key sits on 5 independent protocols. Free tool: check your own Safe.
- defi-admin-key-risk: where a single key (a bare EOA or a 1-of-N Safe) still holds admin power able to mint, pause, or redirect funds. 108 DeFi protocols and lending-vault owners checked by hand, 30 single-key admin cases, each with its timelock or guardian noted where one exists. Free tool: check a contract.
- onchain-postmortems: forensic reconstructions of DeFi and on-chain exploits from raw chain data (all but one, whose chain was rolled back past the attack), with sourced corrections to press and aggregator figures. 64 incidents, $926.0M in losses, $589.1M of it independently recomputed. Free tool: browse incidents and check an address.
- authority-risk-oracle (testnet): for each contract it watches, who can change it, how fast, and what stands in the way (a key, a multisig, a timelock), published as a score any contract can read. Testnet: the oracle contracts sit on testnets, the contracts they score are real deployments. Replay commands, no key needed: three commands. Live readings: the oracle page.
Live site: realspap.github.io · X · Methodology and disclaimer
Every claim rests on an on-chain read or a cited public source. No wallets connected, no tokens, no paid promotion, no affiliation with any protocol covered.
Custom research: want the same checks run on your own protocol or chain, or an authority sheet like these two samples? Write to contact@realspap.com or reach out on X.