In short
- A proxy separates the address you hold from the code that runs.
- Upgradeability is common in legitimate projects — the question is who holds the key.
- Audits describe the implementation that was audited, not the one running now.
How a proxy works
A proxy contract holds the state and the address that users interact with, and forwards calls to a separate implementation contract that holds the logic. Changing the implementation address changes what the token does, without the address anybody holds ever changing.
This is a standard and useful pattern. It is how projects ship fixes without migrating everybody to a new token, and its presence alone is not a warning sign.
The question upgradeability raises
If the logic can change, then today's behaviour is not a commitment about tomorrow's. So the question is not whether the contract is upgradeable but who can upgrade it, and how quickly.
A single externally-owned account that can swap the implementation in one transaction is a very different exposure from a multisig requiring several signers, which is different again from a timelock that must announce a change before it can execute. The owner's account type is reported for exactly this reason.
What this does to an audit
An audit describes the code that was audited. Behind an upgradeable proxy, that is the implementation at the time — not necessarily the one running when you read the report.
Where provider support exists, implementation changes are tracked by monitoring so a swap is visible after the fact. That is detection, not prevention, and it is worth being clear about which of the two you are relying on.
This guide is educational. Cryptoassets are high risk and you could lose all money used to buy them. ScanZX reports observed warning signs and data gaps at scan time — it never certifies that a token is safe. Nothing here is financial advice or a recommendation to buy or sell.