Proxy contract
In short A proxy contract forwards calls to a separate logic contract, letting developers change a token's code later without changing its address.
A proxy contract is a smart contract that holds the address and stored data users interact with, but passes every call on to a separate contract that contains the actual logic. People keep using the same address while the code behind it can be swapped for a new version. Teams use this pattern on Ethereum, BNB Chain, and Base to fix bugs in code that would otherwise be impossible to change.
Mechanically, the proxy uses a delegate call. It runs the logic contract's code against the proxy's own storage, so balances and settings stay at the proxy while the rules come from the implementation. An admin address, which can be a single wallet, a multisig, or a timelock, is allowed to point the proxy at a new implementation. Standards like transparent proxies and UUPS differ in where the upgrade permission lives, but the idea is the same.
This matters because the code you read or saw audited may not be the code running tomorrow. An upgrade can add a mint function, a blacklist, or a hidden sell tax after you have already bought. Renounced ownership on the token can also be misleading, since the upgrade rights usually sit with a separate proxy admin. Plenty of legitimate projects use proxies, so the pattern alone is not a red flag. What counts is who controls the upgrade and how much warning you get.
On a block explorer, check whether the contract is labeled as a proxy and find the implementation address and the admin. Ask whether the admin is a plain wallet or a multisig, whether a timelock forces a delay before upgrades take effect, and whether the audit covers the current implementation rather than an older one. Look at the implementation's history for recent swaps. On Solana the equivalent is an upgradeable program with an upgrade authority, and a revoked authority means the code is frozen.