Trust Protocols Entry #0898 Classified Declassified

Why a code freeze is announced while the admin key stays warm

A code freeze is announced as a promise to stop changing the contract, but a retained admin key means the team can still act — it locks the front, not the back.

No visual record attached The written record below is complete.
Plate 798 — The frozen codebase whose admin key could still move the funds

Intuition test — answer before you read on

Why can a code freeze coexist with the team retaining control of the system?

A protocol announced a code freeze to reassure users that development had stabilised and the contracts would not change. The announcement implied the team had stepped back and the system was now fixed and safe. Yet the admin key remained active, capable of pausing the protocol, adjusting parameters and, in one path, moving funds. The freeze applied to voluntary code changes, not to the standing privileged powers. The advertised lock left a private door warm and usable.

What everyone sees

A user hears code freeze and reads a total halt: nothing can change, so nothing can be tampered with. The phrase sounds like the team has taken its hands off the system. The user infers that a frozen protocol is a locked one, and lowers vigilance about ongoing privileged access, assuming the freeze covers everything the team could do rather than only new development.

What is actually happening

A code freeze is a development convention meaning no new features are being merged; it says nothing about runtime admin powers. Security researchers distinguish stopping changes to the code from renouncing privileged control over the deployed system. A team can freeze development while retaining keys that pause, upgrade via proxy, or extract funds. The announcement borrows the finality of a lock while the operational levers stay in the team’s hands.

Why it stays hidden

The hidden mechanism is the equivocation between two kinds of stopping. Freeze suggests the system is now immobile and safe, but only the development process is frozen; the live control is not. By announcing the freeze and omitting the retained key, the team lets the reader infer a surrender of power that did not occur. The reassuring word covers the front door while the admin key keeps the back door warm.

A freeze stops new code, not standing power. The admin key stays warm behind the announcement of a lock.

A freeze stops new code, not standing power. The admin key stays warm behind the announcement of a lock.

The hidden part — entry #0898

Collect this card

A freeze stops new code, not standing power. The admin key stays warm behind the announcement of a lock.

0 / 10,000 collected

Sources & further reading 2
  1. Atzei, Bartoletti & Cimoli — A Survey of Attacks on Ethereum Smart Contracts (2017)
  2. Walch — Deconstructing Decentralization (2019)

Circulate this file

Annotations are reserved for archive members.

Sign in to annotate