Analysis: Polygon has significant security risks and centralization vulnerabilities
TechFlow Selected TechFlow Selected
Analysis: Polygon has significant security risks and centralization vulnerabilities
Polygon has the opportunity to become a leader in the field, as industry standards must change.
Navigating Web3 tides with focused insightsAuthor: Justin Bons
Compiled by: TechFlow
Polygon remains highly insecure and centralized. Just five individuals can influence over $2 billion in funds, and worse, four of those five are Polygon founders. This could be one of the largest-scale hacks waiting to happen.
The admin keys for Polygon are controlled by 5 out of 8 multi-signature contracts. The founders control the first four, while the remaining four are held by various Polygon committees, meaning there is no fairness. If just one committee colludes with the founders, full control can be obtained.
Controlling the management keys of these contracts equates to having the power to change the rules—anything becomes possible at that point, including draining the entire Polygon network, which currently holds over $2 billion.
Even worse, regarding their operational security and the cryptographic ceremonies used when creating the multi-sig contracts, Polygon has been completely opaque. Since transparency is crucial to even begin establishing trust in a multi-sig setup, this is extremely concerning.
Under such opacity, we have no way of knowing whether certain individuals already control the private keys.
Even more astonishingly, ChrisBlec from DeFiWatch formally requested disclosure on May 20, 2020, and the Polygon team simply refused to respond. This lack of response itself should be seen as a massive red flag.
ChrisBlec continues to speak out against this lack of transparency to this day. On May 15, 2021, Polygon did release a so-called "transparency report." However, this report was merely a justification of the status quo, covering none of the operational security aspects or the cryptographic procedures used during the creation of the admin keys—it only further rationalized the use of this multi-sig setup.
In other words, it was a wholly inadequate response to criticisms raised by me and ChrisBlec. On January 19, 2022, Polygon released their "State of Governance: Decentralization."
I know this practice is now widespread across the cryptocurrency ecosystem. But I’m calling out Polygon specifically because they are one of the largest crypto projects exhibiting this issue.
Polygon has the opportunity to become a leader in the space, because industry standards must change. Polygon can and should lead in that direction. I understand that multi-sigs were the best option in the early stages, but with $2 billion in TVL, Polygon is clearly past its early phase.
Holding so much money without adequate security is obviously a disaster waiting to happen—any smart observer can see that.
This isn’t about the character of the founders—unlike some of my other critiques, I genuinely respect Polygon’s founders and believe they are good people. But that actually makes the situation more difficult.
The founders are confident in themselves. As Mihailo Bjelic put it: “Scams aren't really an issue for Polygon.” I believe he means it sincerely because he trusts himself—but others cannot know what’s in his mind. We shouldn’t just trust; people need to verify.
It's unfair for Polygon to blame ChrisBlec for not offering alternatives. So I will provide a clear alternative path forward—for Polygon, there should be no excuse left.
First, Polygon must decentralize its governance based on Matic token holders. Currently, Polygon’s governance remains overly centralized, following a DPoS model with a small number of validators. Fortunately, Polygon’s “State of Governance” has already laid the groundwork to address this. Once Polygon implements its decentralized governance model:
The founders must hand over the smart contract admin keys to Matic token holders, effectively transferring control to a “Polygon DAO”. However, this would require migrating to new Polygon smart contracts—an extremely difficult and costly process.
But this is the price we pay for not getting things right from the beginning—the cost of achieving true decentralization and the security that comes with it. This is what cryptocurrency is supposed to be about. Pretending to be secure and decentralized is not enough for this industry.
To make this critique constructive, I believe ZEC serves as a broad example, or cases like REP, UNI, and AAVE where admin keys were burned. The DAO should control the admin keys, allowing multi-sig operations to be conducted more securely.
This is a clear path to redemption. Polygon has a real opportunity to lead by example. The foundation is already set—Polygon can take the next step and embrace a more decentralized future.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
