Spap: who actually holds the keys
Admin and multisig key risk across DeFi protocols and the Superchain. Public dashboards, read-only, built on Dune.
Independent on-chain researcher. Everything below is checked directly against RPC calls or replayed from on-chain event history, not taken from a protocol's own disclosures. No wallets connected, nothing for sale, no affiliation with any protocol covered.
Dashboards
41 Gnosis Safe contracts read directly via getOwners() over public RPC, no API key, no indexer. Found 8 people holding signer power on 2 or more unrelated protocols at once, each identified and sourced with a primary citation. The live version replays the actual on-chain event history (AddedOwner, RemovedOwner, SafeSetup) to recompute current ownership fresh on every run, not a point-in-time snapshot.
Same method extended across the Superchain: 55 Safes, 40 protocol and chain deployments, 8 OP Stack chains. Found three more cross-protocol key-sharing cases, plus a pattern specific to the Superchain: several protocols run the identical signer set on every chain they deploy to, so diversifying across a protocol's chains often isn't diversifying at all.
Where a single externally-owned account, not a multisig, still holds an admin role able to mint, pause, or redirect funds in a live protocol. Checked contract by contract against on-chain role data, not against what a protocol's own docs claim.
How concentrated operator power is across EigenLayer AVSs, and what has actually been slashed so far versus what is merely possible under current parameters.
Reconstructing what happened on-chain after a protocol gets hit, transaction by transaction, from the transfers and calls themselves rather than the announcement thread.