★ Sudden admin-rescue/ACL change without discussion
A dev identity & insider risk factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor assesses whether the protocol has executed admin-rescue functions or access-control-list (ACL) changes without any corresponding discussion in public GitHub issues, pull requests, or governance forums. Measurement is conducted by cross-referencing on-chain ACL events against the public activity trail: curator queries the relevant GitHub repository and governance discussion archives for a matching discussion thread within a 14-day window before or after the change. Category 7 context: insider-implant patterns often surface through precisely this signal — privileged code changes committed in silence.
**Why it matters** Legitimate admin interventions are almost always preceded by community discussion, a security disclosure, or at minimum an internal PR. When a rescue or ACL change lands on-chain with no traceable rationale, it is structurally indistinguishable from a rogue insider preparing a drain. The Drift Protocol incident (April 2026) is the clearest recent precedent: a 3-of-5 Security Council threshold reduction and timelock removal were executed without governance-forum precedent discussion six days before a $285M DPRK-attributed exploit. Across the dataset, suspected insider involvement consistently appears alongside undiscussed admin actions — Uranium Finance, Kokomo Finance, and Kannagi Finance all show this pattern.
**Green / Yellow / Red** Green is scored when every admin-rescue invocation or ACL modification in the trailing 90 days has a corresponding public GitHub issue, PR, or governance post predating the on-chain transaction. Yellow applies when documentation exists but is sparse, post-hoc, or restricted to a private channel verifiable only via curator attestation. Red is scored when an admin-rescue or significant ACL change has been executed on-chain with no traceable public discussion in any channel — this single state alone triggers a critical flag under rubric v1.7.0.
**Common gray cases** Gray is assigned when the curator cannot access the protocol's communication channels (e.g., private Discord, closed Telegram), the repo is partially private, or the on-chain event predates the dashboard's monitoring window with no archived record.
**Notable historical examples** - **Uranium Finance** ($57.2M, 2021): Same-day v2.1 deployment followed by GitHub deletion; admin action with no discussion preceded exit. - **Snowdog (SnowdogDAO)** ($21M, 2021): Privileged challengeKey access exercised without prior community disclosure. - **Kokomo Finance** ($4M, 2023): Malicious upgrade executed by anon deployer with no PR or forum discussion; protocol was less than one week old. - **BrincFi** ($1.1M, 2021): Head of development retained full upgrade authority; no discussion before exercise. - **Kannagi Finance** ($1.1M, 2023): Anon team executed MainChef privileged withdrawal absent any governance discussion.
**★ Critical factor** A confirmed red state on this factor — an on-chain admin-rescue or ACL change with no traceable public discussion — is alone sufficient to trigger a D or F grade under rubric v1.7.0, regardless of all other category scores.
Measurement what to look for #
Determine whether any admin-rescue function or ACL change was committed to the repo or executed on-chain without corresponding public discussion in issues, PRs, or governance forum.