What does it mean when a contract is upgradeable? Who controls the upgrade permissions?

Upgradeable contracts are not necessarily insecure, but they raise a question that must be verified: who can change the contract’s execution logic?

When evaluating one, focus on checking:

* Upgrade permissions: Is control held by a single administrator, a multisig, or a governance mechanism?
* Proxy structure: What is the address of the current implementation contract?
* Security safeguards: Are there timelocks and additional approval requirements?
* Upgrade history: Has the implementation contract been replaced recently?
* Version review: Has the new code undergone a security review?

Pay special attention: an unchanged proxy contract address does not mean the underlying execution logic has not changed.

If you cannot confirm who controls the upgrade permissions, or if key changes lack transparent records, you should be cautious.

Don’t just look at the contract address. Look at who controls it and how those permissions are constrained.