What a zero-admin token lock actually means

The keys around a lock

A token lock is a smart contract that holds tokens until a set date. That sounds simple, but a lock is only as strong as the keys around it. Many lockers keep an owner key: an address that can pause the contract, change its fees, or swap its code for a new version through an upgradeable proxy. If that key is ever lost, sold or misused, every lock behind it is at risk at once.

Virtuallock's TokenLock contract has none of those keys. There is no owner, no pause switch and no upgrade path. Once tokens go in, the only address that can ever take them out is the depositor's own, and only after the unlock date.

What "zero-admin" rules out

• No early release. Nobody, including Virtuallock, can withdraw a lock before its unlock date.
• No shortened unlocks. extendLock only accepts a later date. Calling it with an earlier one reverts.
• No fee changes. The flat fee and its recipient are fixed in the contract forever.
• No code swaps. The contract is not behind a proxy, so the code you read is the code that runs.

What it doesn't protect you from

Zero-admin removes one big risk. It doesn't make every token safe. A team can lock its liquidity and still hold a large unlocked share of supply elsewhere. A token's own contract can have a mint function or transfer restrictions that a lock can't touch. Always look at the whole supply, not only the locked part.

The contract has not had a third-party audit yet. Read the security model for exactly what is and isn't guaranteed today.

Further reading

• How to verify a token lock yourself
• Lockers compared: which lockers keep an admin key