How to Find the Real Implementation Address of a Proxy Contract: From Storage Slots to Source Code

The fastest way to find the real implementation address of a proxy contract is to check a block explorer directly. Alternatively, use Etherscan's "Read as Proxy" page, or call eth_getStorageAt to read the EIP-1967 standard storage slot. Block explorers now have mature auto-recognition features that cover the vast majority of mainstream proxy patterns.

OKX Exchange
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！

Register Now App Download

1. Preparation: Understanding Where the Implementation Address Is Stored

According to the EIP-1967 standard, proxy contracts store the implementation address in a specific storage slot to prevent storage collisions with business data.

The storage slot is fixed at: 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc

Prerequisite: You don't need any assets or private keys. You only need the proxy contract address, or the transaction hash of an interaction.

2. Method 1: Check the Block Explorer's "Read as Proxy" (Simplest)

This is the most straightforward approach. Most major block explorers (Etherscan, BscScan) have built-in support for proxy contracts.

Step 1: Confirm Whether the Contract Is Recognized as a Proxy

• What to do: Open the contract address page on Etherscan and check whether a "This address is a proxy" notice appears at the top.

• How to do it: Etherscan has optimized its detection mechanism. In most cases it automatically detects the proxy pattern, so there's no need to manually click "Is this a proxy?" for verification.

• When you're done: You see the page indicating that the address is a proxy contract.

Step 2: Read the Implementation Address Directly

• What to do: Click the "Read as Proxy" tab (or "Contract" > "Read as Proxy").

• How to do it: Look for the implementation() function here and query it.

• When you're done: The page returns a specific 0x address, which is the real implementation contract currently in use. Note that this tab uses the ABI of the implementation contract. If the implementation contract is not open-source, there may be no data to read here, but the implementation address itself still exists.

Step 3: Check Upgrade History (If You Care About Past Versions)

• What to do: If the proxy has been upgraded multiple times and you want to trace historical implementation addresses, look for the "Historical Proxy" tab.

• How to do it: This feature lists all historical upgrade records, each corresponding to an upgrade transaction hash that you can click through to inspect.

• When you're done: You see the complete upgrade chain.

OKX Exchange
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！

Register Now App Download

3. Method 2: Manually Read Storage Slots (For Verification)

If you want to verify independently, or if the block explorer hasn't automatically detected the proxy, you can read the slot directly via RPC.

Step 4: Read the EIP-1967 Storage Slot Using eth_getStorageAt

• What to do: Call eth_getStorageAt, with the target address set to the proxy contract address and the storage position set to 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc.

• How to do it:

  • Option A (using Etherscan): On the "Contract" page under "Read Contract", this functionality isn't directly exposed. You'll need to use the tools under the "Code" tab or call the API directly.

  • Option B (using command line or Web3 libraries): Use curl -X POST with a JSON request, or the web3.eth.getStorageAt() method.

• When you're done: You'll receive a 32-byte piece of data. Strip the first 12 bytes of zero-padding, and the remaining 20 bytes are the implementation address.

Common cause of failure: If the contract does not follow EIP-1967 (for example, a very old custom proxy), this storage slot may contain nothing. In such cases, the block explorer may be unable to auto-detect it, and you may need to manually inspect the contract code for delegatecall logic.

Risk notice: Etherscan's "Read as Proxy" displays the currently bound implementation address, but it cannot guarantee 100% accuracy—if the proxy contract's implementation() function has modified logic, or if the address is obtained dynamically through the Beacon pattern, the page may only show a single source. For operations involving critical funds, it's advisable to compare results across multiple block explorers (e.g., Etherscan vs. Blockscout).

After completing the steps above, how do you confirm you've found the right one?

Once you've found an implementation address, paste that address into the block explorer and search—if the page displays "Contract Source Code Verified," the contract is open-source and you can cross-reference its function signatures against your expected business logic. If it's not open-source, the implementation contract is unverified and calls for heightened caution. Next, if you suspect the proxy may have been maliciously upgraded, use the "Historical Proxy" feature to check the timing and the initiating address of the most recent upgrade.