ContractLens · data study · 2026-10-13

Who holds the keys to Base's top 250 tokens?

We ran the ContractLens token check over the 249 largest tokens in CoinGecko's Base-ecosystem category (by market cap) that have a Base contract address. For each one it reads the chain directly: who owns it, whether it is an upgradeable proxy and who can upgrade it, and which admin functions exist in its bytecode.

Headline numbers

• 47 tokens are canonical bridged copies of L1 tokens: only the OP-stack bridge can mint them, so we leave them out below. That leaves 202 tokens deployed natively on Base.
• 80 of 202 (40%) are upgradeable proxies, so their code can be replaced. Upgrade control: 25 Safe multisig, 12 timelock, 13 a single key, 9 renounced, 7 another contract, 14 not readable.
• 102 have a mint function, 53 can pause transfers, 15 can blacklist or freeze holders, and 4 have an owner-adjustable fee.
• Owner of the 202 native tokens: 76 Safe multisig, 9 timelock, 20 single key, 13 renounced, 16 another contract, 68 with no readable owner (role-based or none).
• Upgradeable with a single key controlling upgrades: USDC, CBBTC, USD0, EURC, GTBTC, CBXRP, AUSD, MAGIC, TGBP, HYPER, USUAL, VNX, CBADA.
• Blacklist or freeze function present: USDC, CBBTC, USD0, EURC, GTBTC, CBXRP, FRXUSD, SOON, UUSD, FP, TETH, USUAL, CYS, CBADA, XSGD.
• 52 have no DEX pair on Base that DexScreener knows of, and 41 have under $10k of Base liquidity. Fine for holding, painful for an agent trying to sell on Base.

How to read this. Admin power is not a scam signal on its own. Fiat stablecoins (USDC, EURC) and wrapped assets (cbBTC) are meant to be issuer-controlled, and "single key" means an externally owned account on-chain: the issuer may guard that key with HSMs and internal approvals that the chain cannot show. The point is to know who can change the token you hold before you buy it, and to compare that with what the project claims.

Key-change alerts (waitlist)

Most of the risk in this table is a key someone can turn later. Alerts would email you within minutes when a token you hold upgrades its implementation, changes owner or proxy admin (for example from a Safe to a single key), lowers its Safe threshold or blacklists an address.

Planned price: $9/month in USDC on Base or Arbitrum, up to 25 tokens. Nothing is charged now. Join the waitlist and you get an email when it opens.

All tokens

Control risk covers admin powers and who holds them. It ignores liquidity. Click a header to sort.

Method and limits

Each row comes from one call to GET https://contractlens-api.appin60.com/token?chainId=8453&address=…. It reads EIP-1967, ZeppelinOS, beacon and EIP-1167 proxy slots; owner(), getOwner(), defaultAdmin() and DEFAULT_ADMIN_ROLE members; Safe thresholds and timelock delays; canonical bridge getters; and does a 4-byte selector scan of the runtime bytecode against a list of admin functions. Liquidity and pair age come from DexScreener. Limits: a selector scan finds functions, not who may call them, and it misses admin functions with non-standard names. There is no buy/sell simulation, so a LOW rating does not rule out a honeypot. Role holders that cannot be enumerated on-chain show as "not found". Not financial advice. Raw data: base-keys.json.

Check any token yourself

Free form on the ContractLens home page. For agents: GET /token costs $0.005 USDC via x402 on Base or Arbitrum, with no key or signup, and is free through the remote MCP server at https://contractlens-api.appin60.com/mcp (tool check_token, 50/day).

Built by ContractLens. Corrections: contractlens@appin60.com