Is it safe to hardcode an Ethereum address in a smart contract for access control purposes?

[joanthecoder]

Is it safe to hardcode an Ethereum address in a smart contract for access control purposes?

[marceontech]

It’s not recommended to hardcode an Ethereum address in a smart contract for access control.

While technically is valid, this approach is inflexible and unsafe in a real-world use.

so if the wallet is lost or compromised, there is no way to change the address without redeploying the contract (unless using upgradeable patterns).
And it also breaks maintainability and limits decentralization or governance.

A better practice would be:

• Store the address in a state variable like owner and protect sensitive functions with onlyOwner.
• Use a secure method to update the address, such as transferOwnership().
• Use OpenZeppelin’s audited libraries like Ownable for secure patterns.

address public owner;

modifier onlyOwner() {
    require(msg.sender == owner, "Not authorized");
    _;
}

function transferOwnership(address newOwner) external onlyOwner {
    owner = newOwner;
}