Paper Thrones: What a Bull Market Forgets About Upgrade Keys, Sequencers, and the Quiet Machinery of Control
We didn't build token-based governance so that a two-of-three Gnosis Safe could outvote the loudest electorate on the internet in the time it takes to pour a glass of overpriced champagne. Yet here we are.
Last month I performed a contract review on a newly funded Layer 2. The announcement had the usual bull-market vocab: “community-owned,” “Ethereum-aligned,” “governance-ready.” The word decentralization appeared eleven times in the pitch. I could almost hear the market cheering. Then I opened the block explorer and looked at the implementation slot. The proxy was managed by an Externally Owned Account, not a DAO. The owner behind that account was a Safe with a threshold of two, and I could not find a timelock anywhere between a signed transaction and a new implementation.
I laughed, because I have been that protocol. In the DeFi Summer of 2020, I did not read the contract closely enough. I ignored my own risk checklist because the yield was mouth-watering, and I dropped my entire personal savings—$15,000 AUD—into an unaudited farming vault. Forty-eight hours later, the funds were gone. I spent the next three months reverse-engineering the exploit and writing a public post-mortem on GitHub. That failure taught me something that now shapes every article I write: when the market is euphoric, the quiet machinery of control is the last place anyone thinks to look.
So let me say this to everyone afraid of missing the next leg up—and maybe to the version of myself from 2020: the real risk is not that your favorite Layer 2 goes to zero in a black swan event. The real risk is that you fall in love with the story and forget to check who holds the keys.
I first fell in love with that story in 2017, when I was an undergraduate economics student reading the Ethereum whitepaper. I was twenty years old and convinced that smart contracts had reinvented the social contract. My peers were hunting for the next ICO flip; I was manually auditing genesis blocks and writing a forty-page thesis called “Code as Law: The Economic Implications of Smart Contracts.” The phrase felt like a promise. Code would replace trusted intermediaries. Consensus would replace hierarchy. We would no longer need to beg a bank or a bureaucrat for permission to move value.
That promise gave birth to the ambitious governance experiments we now see everywhere. DAOs were supposed to be the crystal-clear expression of code-as-law. Token holders would vote. Smart contracts would execute. Nobody could overrule the community because nobody could touch the code. It was a beautiful idea, and like a lot of beautiful ideas, it has been sanded down by the reality of upgradeable contracts.
Here is the technical truth that marketing rarely explains: most major protocols today run behind a proxy. An implementation contract contains the real logic, and a proxy contract points to it via a standard slot—EIP-1967 if you want to dig into the spec. When users interact with the protocol, they call the proxy, and the proxy delegates execution to the current implementation. This pattern is enormously convenient. It allows developers to fix bugs and upgrade features without forcing users to migrate to a new address. But convenience is a double-edged sword, and the hidden side of that blade is governance.
If a protocol is upgradeable, then the thing users need to audit is not only the clever math inside the implementation. The real audit target is the upgrade authority. Who can change that implementation slot? Is it a single private key? Is it a Safe with a threshold of two? Is there a timelock, or can the new code take effect the moment the transaction lands? In practice, I have found that governance tokens often control cosmetic parameters—fee curves, reward allocations, protocol names—while genuine state-changing power sits in a multi-sig wallet controlled by a handful of insiders. Token holders are voting on the paint color of a house whose foundation can be replaced without their permission.
Truth in blockchain isn't a function of how many times the word decentralization appears in the documentation. It is a function of who can alter the implementation slot at 3:00 AM when nobody is watching the explorer. I have learned to check that first, because I know from bitter experience that code can betray the dreams we project onto it.
The clearest public test of this tension happened with Arbitrum in early 2023. On March 19 of that year, the Arbitrum Foundation moved 750 million ARB tokens—roughly a billion dollars at the time—from a wallet that the DAO supposedly controlled. The community erupted. The foundation responded by framing a proposal after the fact, asking token holders to ratify what had already been done. The language was polite, but the power dynamic was unmistakable: the DAO had been asked to approve a transaction that had already been signed. That is not governance; that is a memo. And the uncomfortable part is that this is not an isolated scandal. It is the structural default of upgradeable systems governed by insiders.
The standard defense is that a multi-sig is a safety mechanism. Yes, protocols need to react quickly to vulnerabilities, pause contracts, and patch bugs before they become disasters. But when the threshold is low and the signers are anonymous to the broader community, the safety mechanism becomes a silent veto. Governance can vote for an upgrade for three months, and then a two-of-three Safe can simply choose not to schedule it. Or worse, the Safe can schedule something entirely different. The community participation becomes a ceremony that produces legitimacy, while real authority remains in a private group chat.
Based on my audit experience, I now give projects a simple test: point me to the upgrade key, and tell me honestly what happens if I disagree with its owners. If the answer requires more than a few sentences, your governance model is not ready for the scrutiny of a bear market, let alone the massive inflows of a bull one.
The second throne I keep staring at is the sequencer. Every Layer 2 needs a sequencer to order transactions, produce batches, and post the resulting data to Ethereum. The sequencer is, in essence, the editor of the network newspaper. It decides what gets published, in what order, and when. And despite the rhetoric about decentralized rollups, almost every major Layer 2 runs a sequencer that is a single operator.
This is the uncomfortable fact that bull markets prefer to ignore. The sequencer can reorder transactions to maximize its own profit—something we politely call sequencer MEV. The sequencer can censor transactions from specific addresses if a regulator asks, because a centralized operator is a beautiful point of pressure for any law enforcement agency. And for ordinary users, the experience is entirely smooth until the moment it is not. When a sequencer goes down, orders stop filling, withdrawals get delayed, and the network suddenly feels like a fintech app with a bad uptime record rather than a trustless financial primitive.
Decentralized sequencing has been two years away for... well, for at least two years. I have read the roadmaps. I have attended the conference panels where founders promise that the sequencer will eventually be rotated among a permissionless set of operators. I have seen the same PowerPoint deck with a slightly different color scheme. In the meantime, the canonical mempool remains controlled by a single entity, and the escape hatches remain clunky and slow compared to the seamless UX that centralized sequencers provide.
The common refrain is: “the sequencer cannot steal your funds.” And that is true, mostly. Funds on a well-designed rollup live behind the bridge contract on Ethereum, and even a malicious sequencer cannot just mint themselves a million tokens out of thin air. But this argument misses the point of decentralization, which has never been only about theft. It is about censorship, liveness, and the ability to exit without asking permission. If the sequencer refuses to include your transaction, and the forced-inclusion mechanism takes seven days, then your money is not truly yours in any practical sense. It is yours on paper, and paper does not buy groceries.
The third thing I want to talk about is the one that gets the least attention in Western crypto discourse, because it is happening far from the conference halls of Singapore and New York. In Argentina, Nigeria, Türkiye, and Lebanon, people are not using stablecoins or Bitcoin because they read the Ethereum whitepaper and found it philosophically inspiring. They are using them because their local currency is evaporating in their hands. They are fleeing inflation, not embracing ideology.
This is the truth that changes the entire conversation. In these places, a USDT transaction is not a statement about decentralization; it is survival arithmetic. A teacher in Buenos Aires does not care about zero-knowledge proofs or fraud-proof challenge windows. She cares about whether her salary will still have purchasing power next week. A trader in Lagos does not care whether the sequencer is a permissioned entity; he cares about whether he can receive cross-border payments without losing half the value to intermediaries and exchange-rate spreads.
When I speak to founders who build stablecoin payment products, the ones who are honest will admit that their best traction comes from markets where the state has failed as an economic manager. The demand is not being pulled by “bank the unbanked” empathy campaigns. It is being pushed by hyperinflation and capital controls. Crypto is not a utopian escape hatch in those places; it is a dirty, pragmatic lifeboat.
This changes what I think we owe users. If the only way millions of people can preserve their savings today is a stablecoin running on a chain with a centralized sequencer and a multi-sig-friendly upgrade path, do I tell them to wait until the infrastructure is perfectly decentralized? Do I moralize about sequencer MEV while their salaries melt? I do not have a clean answer. But I know that the bull market narrative—which loves to celebrate “freedom money” without acknowledging the dusty, non-ideological reasons people actually use it—is doing us a disservice. We are building cathedrals and then congratulating ourselves for the spires, while the most important work is happening at the street level.
Now, let me steelman the other side, because the contrarian angle matters and the crypto space is already too good at preaching to its own choir. I believe that centralized sequencers and fast upgrade keys have, in some cases, actually protected users. When a bug is discovered in a smart contract, the ability to pause and upgrade within minutes can prevent catastrophic loss. The 2023 hacks and bridge incidents would have been worse if every protocol had to wait for a slow-moving DAO vote before it could respond to an active exploit. Emergency brakes are not inherently evil; they become evil only when they are hidden, unaccountable, and permanent.
The deeper contrarian point is that decentralization theater can be more harmful than honest centralization. If a project admits that it is run by a committed team with clear upgrade powers, users can make an informed decision. If a project pretends to be fully community-governed while protecting the same upgrade powers behind a permissioned Safe, it creates a false sense of safety. In a bull market, that false sense magnifies capital flows, because retail investors see “claim your governance token” and assume their voice matters. The result is a system with all the dangers of centralization and none of the accountability.
And to be fair, most major protocols have improved. Optimism eventually moved toward an elected Security Council with more signers. Arbitrum became more transparent after the airdrop fiasco, and stepped through the standards that now feel more ordinary. But these improvements are not the end of the road; they are a reminder that real progress comes from structural pressure, not from declarations of intent. We should not celebrate the existence of a Security Council. We should verify the threshold, the identities of its members, and the conditions under which they are allowed to act without community consent.
The final thing I want to say is about language. As a crypto educator, I have watched five years of market cycles teach people to say the right words. Projects are “multi-chain,” “community-first,” “decentralized,” “aligned.” These words are beautiful as a vision, and corrosive as a mask. The bull market amplifies both effects. It gives builders the capital to move fast, but it also gives them the incentive to sell certainty instead of admitting complexity. And the wildest part is that most users, even sophisticated ones, do not bother to look beneath the mask until it is too late.
So here is my small, practical checklist for the next time you fall in love with a protocol, a Layer 2, or a DAO that promises to rewrite the rules of finance. First, find the upgrade authority and understand it completely. Who can change the code? What threshold? What timelock? Second, examine the sequencer or operator: is it a single entity, and would anyone notice if it stopped including your transactions? Third, test the exit: if your funds are stuck, exactly how fast can you get them out without asking permission? And fourth, ask whether the governance token actually controls legs, or only lipstick.
Truth in blockchain isn't always comfortable. It is often boring, sometimes ugly, and frequently hidden behind carefully designed dashboards that obscure more than they reveal. But it is discoverable. Every protocol leaves traces on the chain, in bytecode, in key signatures, in the timestamps of upgrades and the identities of signers. The problem is not that we cannot see the machinery of control. The problem is that, in a bull market, nobody wants to look at it.
We didn't spend a decade building public ledgers and transparent code just to replace a Wall Street back office with a dashboard we are too excited to read. The technology we love so much is not flawed because it uses proxies or multisigs. It is flawed when we pretend otherwise. And the market, with all its noise and euphoria, will eventually reward the projects that stop performing decentralization and start practicing it.
What will that practice look like? I do not know perfectly. But I suspect it will be slower, less visually exciting, and more willing to say “we are not decentralized yet” than most founders today would dare. It will design emergency brakes that expire, upgrade keys that rotate, and sequencers that cannot censor without leaving visible traces for users to escape. The markets will call that cautious; I call it honest.
The bull market will continue to roar while the machinery underneath keeps spinning. The champagne will keep pouring. I will keep checking implementation slots. And every time someone tells me that crypto has solved trust, I will gently remind them that the solving is never finished. It is a daily choice, made by the people who read contracts instead of press releases, and who remember that the point of this whole experiment is not to worship the code, but to make sure the code cannot turn us into subjects.