★ delegatecall/call in proposal execution without allowlist
Aerodrome Finance's assessment for RD-F-039 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Two governor contracts: (1) EpochGovernor (GovernorSimple) has strict minter-only allowlist — can only call IMinter.nudge(); low risk. (2) ProtocolGovernor (VetoGovernor) uses regular call() — not delegatecall — with no target allowlist; arbitrary external calls possible on successful proposals. Vetoer (team multisig) can cancel malicious proposals pre-execution. No delegatecall storage collision risk. Moderate arbitrary-call risk via ProtocolGovernor.
Sources #
- GitHubGovernorSimple.sol — minter-only allowlist for EpochGovernorGovernorSimple.sol — strict allowlist: only minter target, only nudge() selectorretrieved 2026-05-04
- VetoGovernor.sol — call() without allowlistVetoGovernor.sol — targets[i].call{value: values[i]}(calldatas[i]); no allowlist checkretrieved 2026-05-04
Methodology #
Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.
See the full factor methodology and distribution across all protocols →