Half of Base traffic goes to a contract that can be changed after you approve it
Agents sign transactions against contracts whose powers are not visible in an ABI. That premise gets asserted constantly and measured almost never. This is a measurement.
of the most-transacted contracts on Base are upgradeable proxies. They carry 49.9% of transaction volume.
hold at least one of: upgradeability, DELEGATECALL, pause, mint, or
SELFDESTRUCT.
have a proxy chain that cannot be fully resolved — the result we did not expect, and the one that misleads automated callers.
Method
A 60-block window of Base mainnet was read from the head — 10,948 transactions. Every transaction's recipient was counted, and the 300 most-transacted recipients were analysed with the same engine that serves the production endpoint.
Those 300 recipients account for 94% of all transactions in the window. That is what separates this from an anecdote: it is not a curated list of interesting contracts, it is what the chain was actually doing. 292 were contracts; 8 were plain accounts. Analysis is static, over deployed bytecode, with proxies and EIP-7702 delegated accounts resolved to the code that actually executes.
Findings
| Capability present in deployed bytecode | Contracts | Of contracts | Of transactions |
|---|---|---|---|
| Upgradeable proxy | 133 | 45.5% | 49.9% |
Contains DELEGATECALL | 101 | 34.6% | 31.0% |
| Exposes a pause selector | 34 | 11.6% | 10.4% |
| Exposes a mint selector | 14 | 4.8% | 8.6% |
Contains SELFDESTRUCT | 12 | 4.1% | 3.1% |
| Any of the above | 159 | 54.5% | 54.1% |
| Proxy chain not fully resolvable | 43 | 14.7% | 16.5% |
Read the last column as the operational one: it is the probability that the next transaction an agent signs touches such a contract.
The last row is the result we did not expect. For 14.7% of these contracts the proxy chain could not be fully resolved — an implementation slot that is empty, a beacon that does not answer, a hop that terminates without code. An automated caller that reads no capabilities found as clean will score these as safe, when the correct reading is that nothing was established at all.
What this API returns for those cases
The 14.7% only matters if the answer distinguishes them, so this was checked against a live
contract from the sample rather than assumed. For an address whose proxy chain terminates
without resolving, /v1/audit/{address} returns:
| Field | Value |
|---|---|
capabilityRating | UNVERIFIED |
reason | PROXY_RESOLUTION_INCOMPLETE |
reachability | NOT_ESTABLISHED |
executableCapabilities | ["DELEGATECALL", "SELFDESTRUCT"] |
Not an empty capability list, and not a passing grade. A caller reading
capabilityRating cannot mistake this for a clean result — which is the whole
point, because the failure mode being guarded against is an integration that treats
nothing found as nothing there.
Reproducibility
| Finding | Window A | Window B | Difference |
|---|---|---|---|
| Upgradeable proxy | 43.3% | 45.5% | 2.2 |
Contains DELEGATECALL | 33.3% | 34.6% | 1.3 |
| Exposes a pause selector | 10.7% | 11.6% | 0.9 |
| Proxy chain not fully resolvable | 13.7% | 14.7% | 1.0 |
Every figure agrees within 2.2 points, so these are properties of Base traffic rather than of one lucky window. The measurement script is public:
node scripts/research/measure_agent_exposure.js --blocks=60 --max=300The sample is published as machine-readable JSON: base-agent-exposure-sample.json.
What this is not
- Not a safety measurementA pause selector is a fact about deployed bytecode. Most of these contracts are ordinary, well-run, and hold these powers for good reasons. Nothing here says any contract is unsafe, and no addresses are published.
- Not dynamic analysisPresence of an opcode is not proof it is reachable. Reachability is reported separately and is never asserted.
- Not the whole chainThe 6% of transactions beyond the top 300 recipients were not analysed.
A human reviewing a transaction sees a name and an amount. The 45.5% is invisible to them, and to the agent signing on their behalf, unless something reads the bytecode first. The honest version of this is not we will tell you what is safe — we will not. It is: we will tell you what the contract can do, and we will tell you when we could not find out.
Check an address yourself
The same engine that produced this table, on any Base address.
Open the Inspector API Docs Pricing