dYdX's protocol is upgradeable via an admin key with a 3-day timelock and 2-of-3 multisig. The admin key is capable of making changes to critical parts of the smart contract ecosystem.
Timelock: 3 days
dYdX Help CenterArticle
Brahmah Audit Report (see "Highly Privileged Accounts")