Upgradeable DeFi contracts tie emergency exits to rewrite power. My proposal is for Ethereum DeFi builders to separate them.

The power to rescue funds from a DeFi contract and the power to rewrite that contract are two different things, but today a single admin key often holds both.

Many DeFi smart contracts are upgradeable, meaning an admin key can swap out the code governing deposits, loans, trades, and withdrawals while the contract address stays the same. Teams keep upgrade keys because software has bugs and a critical flaw needs a fast fix, but a key that can patch a bug can also rewrite withdrawal rules or take funds from everyone who has already deposited, which is a massive centralization risk.

Here is my proposal:

Instead of depositing directly into a protocol, users could route their funds through a small, immutable safety contract they choose themselves. The user keeps full control of normal deposits and withdrawals, while a separate backup key has the capability to do only one thing, which is to trigger an emergency exit that sends the funds to a safe address the user set in advance. If the backup key holder detects a vulnerability while protocol withdrawals still work, it can pull the funds out immediately without waiting for the user to come online. If the backup key is compromised, the attacker can only force an early exit back to the user's own address, which costs fees and interrupts a strategy, but cannot steal the funds.

A safety contract can only use the exits a protocol already offers, so it cannot recover funds that a bug has already trapped or that an attacker has already stolen. Where a protocol only returns a token representing the deposit rather than the underlying assets, the emergency exit gives the user direct control of that token, but leaves the money exposed to the broken contract until the user redeems it. An extension of this idea would be to allow the safety contract to automatically redeem the token for the underlying asset, before effecting a withdrawal of the underlying asset.

Once emergency exits sit with users, the main argument for upgrade keys in the protocol itself gets much weaker, so core DeFi contracts should be immutable by default. Upgrading an immutable protocol means deploying a new version and letting users move their funds over themselves, so nobody can impose new code on existing deposits. Voluntary migration splits liquidity across versions for a while (like when Uniswap released v3, and a significant share of the liquidity was still living on v2), but it asks users for their consent again instead of assuming it through an in-place upgrade.

If this model were implemented, I predict it would make immutable DeFi the norm, with the rescue function living at the user's edge and the shared protocol remaining credibly neutral.